Bearer CLI is a free, source-available static application security testing (SAST) tool that reads source code without executing it. Its main pitch is that many SAST tools overwhelm developers with long lists of findings, so Bearer instead follows sensitive data through the code and prioritizes flaws that sit on those data paths. That way, triagers can focus on issues most likely to expose personal or otherwise sensitive information.
The scanner ships with built-in rules covering the OWASP Top 10 and CWE Top 25, including SQL injection, cross-site scripting, path traversal, and hard-coded passwords. It also offers a privacy report that identifies more than 120 data types, from personal data to health information, and flags the components that handle them, such as pgSQL databases or third-party APIs like OpenAI and Sentry. The output is intended as evidence for privacy impact assessments and GDPR records of processing activities.
According to Help Net Security, the tool only reads code, never actual values, so a result can show where code handles a field named "email" without revealing whether real customer emails reach it. Bearer CLI supports Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby. It is available on GitHub under the Elastic License 2.0, which permits internal use without commercial requirements but requires approval to offer it as a hosted or managed service to third parties.