# Bearer | Code Security Scanning Tool (SAST) That Discover, Filter And Prioritize Security Risks **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, privacy, freebies, data-recovery\ **Created:** [April 30, 2023, 9:23pm UTC](https://onehack.st/t/bearer-code-security-scanning-tool-sast-that-discover-filter-and-prioritize-security-risks/239702 "2023-04-30T21:23:41Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [April 30, 2023, 9:23pm UTC](https://onehack.st/t/bearer-code-security-scanning-tool-sast-that-discover-filter-and-prioritize-security-risks/239702/1 "2023-04-30T21:23:41Z")
![image](https://onehack.st/uploads/default/original/3X/4/1/41f2d4549eb411a634e87e30fb101d840e5bd568.png) Scan your source code against top **security** and **privacy** risks. Bearer is a static application security testing (SAST) tool that scans your source code and analyzes your data flows to discover, filter and prioritize security and privacy risks. Currently supporting **JavaScript** , **TypeScript** and **Ruby** stacks. 🚧 **Java** support is under active development. [Getting Started](https://github.com/Bearer/bearer#rocket-getting-started) - [FAQ](https://github.com/Bearer/bearer#question-faqs) - [Documentation](https://docs.bearer.com/) - [Report a Bug](https://github.com/Bearer/bearer/issues/new/choose) - [Discord Community](https://discord.gg/eaHZBJUXRF) [![GitHub Release](https://camo.githubusercontent.com/ab305f2479ff5a23b9e686813f2ced48d8f4810c1b3367be03a581e05f042920/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f4265617265722f6265617265722e7376673f6c6f676f3d676974687562)](https://github.com/Bearer/bearer/releases) [![Test](https://github.com/Bearer/bearer/actions/workflows/test.yml/badge.svg)](https://github.com/Bearer/bearer/actions/workflows/test.yml) [![Contributor Covenant](https://camo.githubusercontent.com/966523edeac6e0c8fc3afeb347df2aaccd7407c0885946e96aa3c5297ebecb59/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f436f6e7472696275746f72253230436f76656e616e742d322e312d3462616161612e737667)](https://github.com/Bearer/bearer/blob/main/CODE_OF_CONDUCT.md) [![Discord](https://camo.githubusercontent.com/57e06f6fd101faf430a5928334316ece0f19129dc19622cd3a85defaa6933ad8/68747470733a2f2f696d672e736869656c64732e696f2f646973636f72642f313034323134373437373736353234323937333f6c6162656c3d646973636f7264)](https://discord.gg/eaHZBJUXRF) ## Developer friendly static code analysis for security and privacy * * * bearer-cli-overview-cc.mp4 Bearer provides built-in rules against a common set of security risks and vulnerabilities, known as [OWASP Top 10](https://owasp.org/www-project-top-ten/), and privacy risks. Here are some practical examples of what those rules look for: - Non-filtered user input (sql injection, path traversal, etc.) - Leakage of sensitive data through cookies, internal loggers, third-party logging services, and into analytics environments. - Usage of weak encryption libraries or misusage of encryption algorithms. - Unencrypted incoming and outgoing communication (HTTP, FTP, SMTP) of sensitive data. - Hard-coded secrets and tokens. And many [more](https://docs.bearer.com/reference/rules/). Bearer is Open Source ([_see license_](https://github.com/Bearer/bearer#mortar_board-license)) and fully customizable, from creating your own rules to component detection (database, API) and data classification. Bearer also powers our commercial offering, [Bearer Cloud](https://www.bearer.com/), allowing security teams to scale and monitor their application security program using the same engine. ## 🚀 Getting started Discover your most critical security risks and vulnerabilities in only a few minutes. In this guide, you will install Bearer, run a security scan on a local project, and view the results. Let’s get started! ### Install Bearer The quickest way to install Bearer is with the install script. It will auto-select the best build for your architecture. _Defaults installation to `./bin` and to the latest release version_: curl -sfL [https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh](https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh) | sh #### Other install options HomebrewDebian/UbuntuRHEL/CentOSDockerBinary ### Scan your project The easiest way to try out Bearer is with the OWASP [Juice Shop](https://github.com/juice-shop/juice-shop) example project. It simulates a realistic JavaScript application with common security flaws. Clone or download it to a convenient location to get started. git clone [https://github.com/juice-shop/juice-shop.git](https://github.com/juice-shop/juice-shop.git) Now, run the scan command with `bearer scan` on the project directory: bearer scan juice-shop A progress bar will display the status of the scan. Once the scan is complete, Bearer will output, by default, a security report with details of any rule findings, as well as where in the codebase the infractions happened and why. By default the `scan` command use the SAST scanner, other [scanner types](https://docs.bearer.com/explanations/scanners) are available. ### Analyze the report The security report is an easily digestible view of the security issues detected by Bearer. A report is made up of: - The list of [rules](https://docs.bearer.com/reference/rules/) run against your code. - Each detected finding, containing the file location and lines that triggered the rule finding. - A stat section with a summary of rules checks, findings and warnings. The [OWASP Juice Shop](https://github.com/juice-shop/juice-shop) example application will trigger rule findings and output a full report. Here’s a section of the output: ```auto ... HIGH: Sensitive data stored in HTML local storage detected. [CWE-312] https://docs.bearer.com/reference/rules/javascript_lang_session To skip this rule, use the flag --skip-rule=javascript_lang_session File: juice-shop/frontend/src/app/login/login.component.ts:102 102 localStorage.setItem('email', this.user.email) ===================================== 59 checks, 40 findings CRITICAL: 0 HIGH: 16 (CWE-22, CWE-312, CWE-798, CWE-89) MEDIUM: 24 (CWE-327, CWE-548, CWE-79) LOW: 0 WARNING: 0 ``` In addition of the security report, you can also run a [privacy report](https://docs.bearer.com/explanations/reports/#privacy-report). Ready for the next step? Additional options for using and configuring the `scan` command can be found in [configuring the scan command](https://docs.bearer.com/guides/configure-scan/). For more guides and usage tips, [view the docs](https://docs.bearer.com/). ## ❓ FAQs ### What makes Bearer different from any other SAST tools? SAST tools are known to bury security teams and developers under hundreds of issues with little context and no sense of priority, often requiring security analysts to triage issues manually. The most vulnerable asset today is sensitive data, so we start there and [prioritize](https://github.com/Bearer/bearer/issues/728) findings by assessing sensitive data flows to highlight what is more critical, and what is not. This unique ability allows us to provide you with a privacy scanner too. We believe that by linking security issues with a clear business impact and risk of a data breach, or data leak, we can build better and more robust software, at no extra cost. In addition, by being Open Source, extendable by design, and built with a great developer UX in mind, we bet you will see the difference for yourself. ### What is the privacy scanner? In adition of detecting security flaws in your code, Bearer allows you to automate the evidence gathering process needed to generate a privacy report for your compliance team. When you run Bearer on your codebase, it discovers and classifies data by identifying patterns in the source code. Specifically, it looks for data types and matches against them. Most importantly, it never views the actual values—it just can’t—but only the code itself. If you want to learn more, here is the [longer explanation](https://docs.bearer.com/explanations/discovery-and-classification/). Bearer is able to identify over 120+ data types from sensitive data categories such as Personal Data (PD), Sensitive PD, Personally identifiable information (PII), and Personal Health Information (PHI). You can view the full list in the [supported data types documentation](https://docs.bearer.com/reference/datatypes/). Finally, Bearer also lets you detect components storing and processing sensitive data such as databases, internal APIs, and third-party APIs. See the [recipe list](https://docs.bearer.com/reference/recipes/) for a complete list of components. ### Supported Language Bearer currently supports JavaScript, TypeScript and Ruby and their associated most used frameworks and libraries. Java support is under active development, more languages will follow. ### How long does it take to scan my code? Is it fast? It depends on the size of your applications. It can take as little as 20 seconds, up to a few minutes for an extremely large code base. We’ve added an internal caching layer that only looks at delta changes to allow quick, subsequent scans. Running Bearer should not take more time than running your test suite. ### What about false positives? If you’re familiar with SAST tools, false positives are always a possibility. By using the most modern static code analysis techniques and providing a native filtering and prioritizing solution on the most important issues, we believe this problem won’t be a concern when using Bearer. ### When and where to use Bearer? We recommend running Bearer in your CI to check new PRs automatically for security issues, so your development team has a direct feedback loop to fix issues immediately. You can also integrate Bearer in your CD, though we recommend setting it to only fail on high criticality issues, as the impact for your organization might be important. In addition, running Bearer on a scheduled job is a great way to keep track of your security posture and make sure new security issues are found even in projects with low activity. ## ✋ Get in touch Thanks for using Bearer. Still have questions? - Start with the [documentation](https://docs.bearer.com/). - Have a question or need some help? Find the Bearer team on [Discord](https://discord.gg/eaHZBJUXRF). - Got a feature request or found a bug? [Open a new issue](https://github.com/Bearer/bearer/issues/new/choose). - Found a security issue? Check out our [Security Policy](https://github.com/Bearer/bearer/security/policy) for reporting details. - Find out more at [Bearer.com](https://www.bearer.com/) ## 🤝 Contributing Interested in contributing? We’re here for it! For details on how to contribute, setting up your development environment, and our processes, review the [contribution guide](https://github.com/Bearer/bearer/blob/main/CONTRIBUTING.md). ## 🚨 Code of conduct Everyone interacting with this project is expected to follow the guidelines of our [code of conduct](https://github.com/Bearer/bearer/blob/main/CODE_OF_CONDUCT.md). ## 🛡 Security To report a vulnerability or suspected vulnerability, [see our security policy](https://github.com/Bearer/bearer/security/policy). For any questions, concerns or other security matters, feel free to [open an issue](https://github.com/Bearer/bearer/issues/new/choose) or join the [Discord Community](https://discord.gg/eaHZBJUXRF). ## 🎓 License Bearer code is licensed under the terms of the [Elastic License 2.0](https://github.com/Bearer/bearer/blob/main/LICENSE.txt) (ELv2), which means you can use it freely inside your organization to protect your applications without any commercial requirements. You are not allowed to provide Bearer to third parties as a hosted or managed service without the explicit approval of Bearer Inc. ## GitHub: > **[GitHub - Bearer/bearer: Code security scanning tool (SAST) to discover,...](https://github.com/Bearer/bearer)** > > Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.