bearer - Code security scanning tool (SAST) to discover, fi

项目说明

<di="center">
<a href=" alt="Bearer is part of Cygives, the community hub for free & open de security tools."/>
<picture>
<源码 media="(prefers-color-scheme: dark)" srcset="./docs/assets/img/Cygi.svg">
<img alt="Cygi" src="./docs/assets/img/Cygi.svg">
</picture>
</a>
<br/>
<br/>
<picture>
<源码 media="(prefers-color-scheme: dark)" srcset="./docs/assets/img/bearer-logo-dark.svg">
<img alt="Bearer" src="./docs/assets/img/bearer-logo-light.svg">
</picture>
<br />
<hr/>
Scan your 源码 代码 against top <strong>security</strong> and <strong>privacy</strong> risks.
<br /><br />
Bearer is a static application security testing (SAST) 工具 designed to scan your 源码 代码 and analyze data flows to identify, filter, and prioritize security and privacy risks.
<br/><br/>
Bearer offers a free, open solution, Bearer CLI, and a commercial solution, Bearer Pro, a through <a href="
<br /><br />

Getting Started - FAQ - Documentation - Report a Bug

[![GitHub Release][release-img]][release]
[![Test][test-img]][test]

</div>

Language Support

Bearer CLI (Open Source): Go • Java • Ja • TypeScript • PHP • Python • Ruby

Bearer Pro by Cycode: _All Bearer CLI languages plus:_

<a href=" more about language support</a>

De friendly static 代码 analysis for security and privacy

<

Bearer CLI scans your source code for:

- A01: Access control (e.g. Path Tra, Open Redirect, Exposure of Sensiti).
- A02: Cryptographic Failures (e.g. Weak Algorithm, Insecure Communication).
- A03: Injection (e.g. SQL Injection, Input , XSS, XPath).
- A04: Design (e.g. Missing Encryption of Sensitive Data, Persistent Cookies Containing Sensiti).
- A05: Security Misconfiguration (e.g. Cleartext Storage of Sensiti in a Cookie or JWT).
- A07: Identification and Authentication Failures (e.g. Use of Hard-coded Password, Improper Certificate ).
- A08: Data Integrity Failures (e.g. Deserialization of Untrusted Data).
- A09: Security Logging and Monitoring Failures (e.g. Insertion of Sensiti into Log File).
- A10: Ser Request Forgery (SSRF).

_Note: all the rules and their 代码 patterns are accessible through the documentation._

:rocket: Getting started

Discover your most critical security risks and in only a few minutes. In this guide, you will install Bearer CLI, run a security scan on a local project, and view the results. Let's get started!

Install Bearer CLI

The quickest way to install Bearer CLI is with the install script. It will auto-select the best build for your architecture. _Defaults installation to ./bin and to the latest release :

#### Other install options

<details>
<summary>Homebrew</summary>

Using Bearer CLI's official Homebrew tap:

Update an existing installation with the following:

</details>

<details>
<summary>Debian/Ubuntu</summary>

Update an existing installation with the following:

</details>

<details>
<summary>RHEL/CentOS</summary>

Add repository setting:

Then install with yum:

Update an existing installation with the following:

</details>

<details>
<summary>Docker</summary>

Bearer CLI is also a as a Docker image on Docker Hub and ghcr.io.

With docker installed, you can run the following command with the appropriate paths in place of the examples.

Additionally, you can use docker compose. Add the following to your docker-compose.yml file and replace the with the appropriate paths for your project:

Then, run the docker compose run command to run Bearer CLI with any specified flags:

The Docker configurations above will always use the latest release.

</details>

<details>
<summary>Binary</summary>

Download the archive file for your operating system/architecture from here.

Unpack the archive, and put the binary somewhere in your $PATH (on UNIX-y systems, /usr/local/bin or the like). Make sure it has permission to execute.

To update Bearer CLI when using the binary, download the latest release and o your existing installation location.

</details>
<br/>

Scan your project

The easiest way to try out Bearer CLI is with the OWASP Juice Shop example project. It simulates a realistic Ja application with common security flaws. Clone or download it to a con location to get started.

Now, run the scan command with bearer scan on the project directory:

A progress bar will display the status of the scan.

Once the scan is complete, Bearer CLI will output, by default, a security report with details of any rule findings, as well as where in the codebase the infractions happened and why.

By default the scan command use the SAST scanner, other scanner types are a.

Analyze the report

The security report is an easily digestible view of the security issues detected by Bearer CLI. A report is made up of:

The OWASP Juice Shop example application will trigger rule findings and output a full report. Here's a section of the output:

In addition of the security report, you can also run a privacy report.

Ready for the next step? Additional options for using and configuring the scan command can be found in configuring the scan command.

For more guides and usage tips, view the docs.

:question: FAQs

What makes Bearer CLI different from any other SAST tools?

SAST tools are known to bury security teams and de under hundreds of issues with little context and no sense of priority, often requiring security analysts to triage issues manually.

The most asset today is sensitive data, so we start there and prioritize findings by assessing sensitive data flows to highlight what is more critical, and what is not. This unique ability allows us to provide you with a privacy scanner too.

We believe that by linking security issues with a clear business impact and risk of a data breach, or data leak, we can build better and more robust software, at no extra cost.

In addition, by being Free and Open, extendable by design, and built with a great de UX in mind, we bet you will see the difference for yourself.

What is the privacy scanner?

In addition of detecting security flaws in your 代码, Bearer CLI allows you to automate the e gathering process needed to generate a privacy report for your compliance team.

When you run Bearer CLI on your codebase, it discovers and classifies data by identifying patterns in the 源码 代码. Specifically, it looks for data types and matches against them. Most importantly, it ne the actual —it just can’t—but only the 代码 itself. If you want to learn more, here is the longer explanation.

Bearer CLI is able to identify over 120+ data types from sensitive data categories such as Personal Data (PD), Sensitive PD, Personally identifiable information (PII), and Personal Health Information (PHI). You can view the full list in the supported data types documentation.

Finally, Bearer CLI also lets you detect components storing and processing sensitive data such as databases, internal APIs, and third-party APIs. See the recipe list for a complete list of components.

Supported Language

Learn more about language support.

How long does it take to scan my 代码? Is it fast?

It depends on the size of your applications. It can take as little as 20 seconds, up to a few minutes for an extremely large 代码 base.

As a rule of thumb, Bearer CLI should never take more time than running your test suite.

In the case of CI integration, we provide a diff scan solution to make it e. Learn more.

What about false positives?

If you’re familiar with SAST tools, false positives are always a possibility.

By using the most modern static 代码 analysis techniques and pro a nati and prioritizing solution on the most important issues, we believe we ha improved the o SAST experience.

We strive to provide the best possible experience for our users. Learn more about how we achieve this.

When and where to use Bearer CLI?

We recommend running Bearer CLI in your CI to check new PRs automatically for security issues, so your de team has a direct feedback loop to fix issues immediately.

You can also integrate Bearer CLI in your CD, though we recommend setting it to only fail on high criticality issues, as the impact for your organization might be important.

In addition, running Bearer CLI as a scheduled job is a great way to keep track of your security posture and make sure new security issues are found even in projects with low activity.

Make sure to read our integration strategy guide for more information.

Do you support interprocedural and inter-file analysis?

Yes, Bearer Pro supports interprocedural and inter-file analysis, currently with full capabilities for Ja, C#, and Go, and actively being extended to other major supported languages. This ad analysis allows Bearer Pro to trace data flow and control flow across function and file boundaries within an entire codebase. This is crucial for accurately identifying complex that depend on the interaction of different 代码 components, significantly reducing false positi to analyses limited to indi functions or files.

Bearer Pro's interprocedural and inter-file analysis for Java has demonstrated strong results on the OWASP Ja, achieving a score of 76% with a reported false positive rate of less than 2%.

:raised_hand: Get in touch

Thanks for using Bearer CLI. Still ha?

:handshake: Contributing

Interested in contributing? We're here for it! For details on how to contribute, setting up your de en, and our processes, review the contribution guide.

:rotating_light: Code of conduct

E interacting with this project is expected to follow the guidelines of our 代码 of conduct.

:shield: Security

To report a or suspected , see our security policy. For any questions, concerns or other security matters, feel free to open an issue.

:mortar_board: License

Bearer CLI 代码 is licensed under the terms of the Elastic License 2.0 (ELv2), which means you can use it freely inside your organization to protect your applications without any commercial requirements.

You are not allowed to provide Bearer CLI to third parties as a hosted or managed service without the explicit approval of Bearer Inc.

---

[test]:
[test-img]:
[release]:
[release-img]:

项目信息

开发语言：Go

Star 数：2754

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕代码 security scanning 工具 (SAST) to discover, filter and prioritize security and privacy risks.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。