Bearer CLI gives website owners and developers a free way to scan source code for common vulnerabilities and prioritize findings by the sensitive data they may expose. The scanner reads code without running it, supports seven programming languages, and is available under the Elastic License 2.0 for internal use.
Bearer CLI is available for free in its GitHub repository.
What Website Owners Need to Know
Bearer CLI is a static application security testing tool. Static analysis means it examines source code instead of executing the application. According to the Bearer CLI documentation, a scan parses project files into an abstract syntax tree, performs data discovery and classification, updates the tree, and generates internal detection reports that check findings against rules. Except for loading rules from the bearer-rules repository and checking its latest version, the process runs locally.
The project says this approach addresses a common problem with SAST tools. Those tools can return hundreds of findings without indicating which should be handled first. Bearer CLI follows sensitive data through the code and places flaws on those paths ahead of other results.
It tells the reviewer where a finding intersects with sensitive data, which can make a large results list easier to work through.
What Bearer CLI Can Inspect
The built-in rules cover the OWASP Top 10 and CWE Top 25. NIST’s source code security analyzer overview describes these tools as examining source code to detect and report weaknesses that can lead to security vulnerabilities, making them one of the last lines of defense for eliminating software vulnerabilities during development or after deployment.
Bearer CLI’s rules include SQL injection, cross-site scripting, path traversal, and hard-coded passwords. Its documentation also explains how dataflow analysis identifies external input, traces it through the application, and flags cases where it reaches a sensitive location without being sanitized. That is the mechanism behind the tool’s prioritization: a finding connected to a path carrying sensitive information receives greater attention than a finding in code that does not touch that data.
The scanner can also produce a privacy report. It identifies more than 120 data types, ranging from personal data to health information, and flags components that handle them, including databases such as pgSQL and third-party APIs such as OpenAI and Sentry. The output is intended as supporting evidence for privacy impact assessments and GDPR records of processing activities.
Bearer says the scanner may read only code, not actual values. A result can show where code handles a field named email without showing whether real customer email addresses reach that field.
Supported Languages and License
| Reference | Details |
|---|---|
| Supported languages | Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby |
| License | Elastic License 2.0 |
| Internal use | Organizations can use the CLI internally without commercial requirements |
| Hosted or managed service for third parties | Requires approval from the project |
| Availability | Free download from the project’s GitHub repository |
The scan covers application source code. It does not establish whether a particular running website is compromised.
What It Cannot Establish
Bearer CLI reads code without running it, so it may not confirm the state of a live server, the data stored in a database, or whether an attacker has already used a weakness. Its own project documentation notes that tracing a data source and identifying whether it is sanitized before use in sensitive locations is the most difficult part of the analysis, which is why custom rules and sanitizers can be added.
Results still need to be checked against the application’s actual behavior.
Neither Bearer nor the reporting of its release identifies a particular website as affected. Whether a scan produces findings depends on the code it examines and the rules it applies.
How to Interpret and Verify Findings
Start with the results linked to sensitive-data paths, then work through the remaining findings. Keep the rule identifier and affected file location with each result.
For each sensitive-data path, confirm the flow manually. Identify where external input enters the application, where it travels, and whether it passes through a sanitizer before reaching a sensitive location. The Bearer documentation illustrates this with cross-site scripting: input taken from a request query string is treated as tainted, and it remains tainted when written to a response without HTML encoding. A finding may not be raised when the same input is sanitized first.
In a paper published in Applied Soft Computing, researchers testing a scanner for AI agent skills reviewed 59 findings from 1,587 skills in 75 GitHub repositories. Three analysts confirmed 53 of those findings, a precision rate of 89.8%. The authors also noted limitations in existing scanners, including their focus on malicious skills rather than unintended vulnerabilities in skills from public repositories. Read the study.
Licensing and Permitted Use
Bearer CLI is distributed under the Elastic License 2.0. An organization can use the command-line tool internally without commercial requirements. Providing it to third parties as a hosted or managed service requires approval from the project. That distinction matters for agencies and hosting providers considering whether to add the tool to a client offering.
Where This Fits in a Broader Site Audit
Bearer CLI addresses application source code. Source-code review can surface that pattern.
PHP maintainers rated both vulnerabilities 9.2 out of 10 on CVSS, and fixes shipped on October 21 for PHP 8.2 and newer. According to the PHP release notes, updating is the only safe choice because there are no complete mitigations.
According to [SEOScanPro](https://seoscanpro.ai), its tool can run comprehensive website SEO audits, including a local SEO audit and on-page analysis.
Website-Owner Source-Code Review Checklist
Work through these questions before treating a Bearer CLI report as an audit result:
- Confirm who is authorized to review the code. Ask the developer, agency, or hosting provider who controls the repository. Do not copy source code into an environment that is not approved for handling the site’s code.
- Confirm the scan includes supported application code. Check that the repository contains application source in one of the seven supported languages. Decide with the developer whether themes, plugins, generated files, and dependencies should be included, because their inclusion changes both the findings and the remediation work.
- Preserve the rule identifiers and affected locations. Keep the rule name, file path, and reported code location for each finding. Without those details, a result cannot be traced back to the code or assigned for correction.
- Verify sensitive-data paths by hand. For each prioritized finding, follow the data from its entry point to the reported sink and check whether a sanitizer handles it. This step is necessary because Bearer documents source tracing and sanitization as the hardest part of the analysis.
- Confirm and remediate before recording the issue as closed. Ask the developer to confirm the affected behavior and apply the fix or accepted mitigation. Re-run the scan to check the result after the change.
Tails 3.4 Release
Tails 3.4 and Bearer CLI both concern security-focused software, but they address different technical needs. According to LWN.net’s release report, it updated the kernel to version 4.14.12 to include the latest Meltdown and Spectre patches, fixed many other security issues, and prompted users to upgrade.
Bearer CLI examines application source code without running it. It supports seven programming languages and ranks findings according to the sensitive data they may expose.
FAQ
What Is Bearer CLI?
Bearer CLI is available as a free, source-available static application security testing tool that can scan source code for vulnerabilities without running the code. It prioritizes findings by the sensitive data they touch.
Which Programming Languages Does Bearer CLI Support?
Bearer CLI supports Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby.
Can Bearer CLI Be Used for Free?
Yes. The tool is available for free on GitHub. Internal use may carry no commercial requirement under the Elastic License 2.0, while providing it to third parties as a hosted or managed service may require approval.
Try the AI visibility report
SEOScanPro runs comprehensive website SEO audits, including a local SEO audit and on-page analysis.