Bearer

No entries match these filters. Clear filters

1. docs update Oct 3, 2026 · issue 093

   Bearer CLI scan configuration guide documents differential scanning, rule skipping, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./HTML output, and secrets scanning flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan only new findings introduced on a feature branch compared to a specific base branch, avoiding full-codebase rescans in CI.
   copy

   $ git checkout my-feature
   BEARER_DIFF_BASE_BRANCH=main bearer scan --diff .

   Detect hard-coded secrets in your codebase using the built-in secrets scanner instead of the default SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanner.
   copy

   $ bearer scan --scanner secrets .

   Generate a SARIF report from a security scan and write it to disk for upload to GitHub Advanced Security or another SARIF-consuming tool.
   copy

   $ bearer scan --format sarif --output sarif-report.sarif .

   • Adds --diff flag to bearer scan for differential scanning, reporting only new findings relative to a base branch to reduce scan times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds BEARER_DIFF_BASE_BRANCH environment variable to override the default base branch used in differential scanning.
   • Adds --scanner secrets flag to bearer scan to enable the built-in secrets scanner for detecting hard-coded secrets.
   • Adds --report flag to bearer scan to select report types such as privacy or dataflow instead of the default Security report.
   • Adds --skip-rule flag to bearer scan to exclude specific rules by ID (e.g., ruby_lang_exception) for an entire scan.

   +10 more show less

   • Adds skip-rule key to bearer.yml config file to persistently skip rules without passing flags on each invocation.
   • Adds --only-rule flag to bearer scan to restrict a scan to specific rule IDs only.
   • Adds bearer ignore add subcommand with optional --author, --comment, and --false-positive flags to suppress findings by fingerprint.
   • Adds bearer:disable inline comment directive to skip specific rules for individual code blocks or lines in Ruby and JavaScript.
   • Adds --severity flag to bearer scan to filter results to specific severity levels: critical, high, medium, low, and warning.
   • Adds --exit-code flag to bearer scan to force a specific exit code (e.g., 0) regardless of findings, useful for non-blocking CI/CD pipelines.
   • Adds --format sarif output format to bearer scan for SARIF-compatible tooling, usable with --output to write to disk.
   • Adds --format html output format to bearer scan for human-readable HTML security and privacy reports.
   • Adds --format yaml output format to bearer scan as an alternative to the default output format.
   • Adds --output flag to bearer scan to write report results directly to a specified file path.

   15 details in Everything

2. docs update Oct 3, 2026 · issue 093

   Bearer CLI adds three report types: security, privacy, and dataflow, each with distinct flags and output formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run a SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. security scan on your codebase to get CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-tagged findings with file and line context.
   copy

   $ bearer scan . --report security

   Generate a privacy report with custom data-subject mappings (e.g. mapping to Patient, Employee) instead of the default User catchall.
   copy

   $ bearer scan . --report=privacy --data-subject-mapping=/path/to/mappings.json

   Produce a detailed dataflow report to trace every location where email addresses or other sensitive fields are read, stored, or sent to third parties.
   copy

   $ bearer scan . --report dataflow

   • Adds --report security flag to bearer scan to surface SAST findings with file, line, and code-snippet context, plus CWE-tagged severity counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --report privacy flag to bearer scan to produce a CSV breakdown of data subjects, data types, detection counts, and third-party service exposure (via Recipes).
   • Adds --data-subject-mapping=<path> flag to bearer scan --report privacy to override default subject mappings with a custom JSON file following the subject_mapping.json format.
   • Adds --report dataflow flag to bearer scan to emit a JSON report of every location where personal or sensitive data is processed, stored, or exposed to third parties.

   4 details in Everything

3. docs update Oct 3, 2026 · issue 093

   Bearer CLI documents two scanner types: --scanner=sast (default) and --scanner=secrets for hard-coded secret detection via Gitleaks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan a codebase for hard-coded secrets such as passwords, API keys, and tokens embedded in source files.
   copy

   $ bearer scan . --scanner=secrets

   • Adds --scanner=secrets flag to detect hard-coded secrets (keys, tokens, passwords) in code using the Gitleaks library, reporting findings with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-798.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --scanner=sast flag to explicitly invoke the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanner (also the default) for security risk and vulnerability detection via built-in rules.
   • Adds --scanner=secrets flag to detect hard-coded secrets (keys, tokens, passwords) in code using the Gitleaks library, reporting findings with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-798.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. docs update Oct 3, 2026 · issue 093

   Bearer CLI gains shell completion support for zsh, bash, and fish via bearer completion⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Persist zsh completions for every new shell session on macOS when Bearer is installed via Homebrew.
   copy

   $ bearer completion zsh > $(brew --prefix)/share/zsh/site-functions/_bearer

5. docs update Oct 3, 2026 · issue 093

   Documentation page describing Bearer's cross-file (interprocedural/inter-file) static analysis capability, available in Bearer Pro.

   • New supported platformCross-file analysis (interprocedural and inter-file data-flow tracing across function and file boundaries) is available as a Pro-only capability for Java, Python, C#, and Go.

   1 detail in Everything

6. docs update Oct 3, 2026 · issue 093

   Bearer: Adds bearer scan <path> with --format supporting json, yaml, sarif, gitlab-sastgitlab-sastGitLab's built-in static analysis feature that scans source code for vulnerabilities during CI/CD pipelines, letting cyber tools integrate findings directly into merge-request workflows without external scanners., rdjson, and html output formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Produce a SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. report scoped to secrets and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanners, failing CI only on critical or high findings, and write output to a file.
   copy

   $ bearer scan /path/to/your_project --scanner=secrets,sast --format=sarif --output=results.sarif --fail-on-severity=critical,high --exit-code=1

   Flag a noisy finding as a false positive so it is suppressed in future scans, with author and comment for audit trail.
   copy

   $ bearer ignore add <fingerprint> --author 'Alice' --comment 'Confirmed false positive in test harness' --false-positive

   In a PR pipeline, scan only changes relative to the main branch and emit a GitLab-compatible SAST report.
   copy

   $ bearer scan . --diff --format=gitlab-sast --output=gl-sast-report.json --scanner=sast

   • Adds --context flag to bearer scan to expand schema classification (e.g. --context=health) for domain-specific data types.
   • Adds --external-rule-dir flag to bearer scan to load custom .yaml rule files from specified directories.
   • Adds --fail-on-severity and --exit-code flags to bearer scan to control CI pass/fail behaviour by severity threshold.
   • Adds --skip-path flag to bearer scan to exclude comma-separated files or directories, supporting * glob syntax.
   • Adds --disable-default-rules flag to bearer scan to turn off all built-in rules.

   +9 more show less

   • Adds --include-stats flag to bearer scan to embed language usage statistics in supported report formats.
   • Adds --no-extract flag to bearer scan to omit code extracts from reports.
   • Adds --skip-git-ignore flag to bearer scan to scan files whose paths match .gitignore patterns.
   • Adds bearer init command to generate a default bearer.yml configuration file.
   • Adds bearer ignore show <fingerprint> with --all flag to inspect one or all entries in the bearer.ignore file.
   • Adds bearer ignore remove <fingerprint> to delete a suppressed finding from the bearer.ignore file.
   • Adds bearer ignore migrate to move ignored fingerprints from bearer.yml into the dedicated bearer.ignore file.
   • Adds bearer version command to print the installed CLI version.
   • Adds --config-file flag (env BEARER_CONFIG_FILE, default bearer.yml) and --ignore-file flag (env BEARER_IGNORE_FILE, default bearer.ignore) across all commands for explicit config and ignore file paths.

   14 details in Everything

7. docs update Oct 3, 2026 · issue 093

   Bearer: Adds scan.context, scan.data-subject-mapping, scan.external-rule-dir, scan.internal-domains, and scan.skip-path keys in bearer.yml for fine-grained scan classification and scoping.

   └──▷ TRY IT
   Store a shared org-wide config outside any repo and point individual scans at it, so every team uses the same rule exclusions and severity thresholds.
   copy

   $ bearer scan . --config-file /etc/bearer/bearer.yml

   Pin a project to run only specific rules and skip noisy low-severity findings, without memorising flags on every invocation.
   bearer.yml copy

   # bearer.yml in project root
   rule:
     only-rule: [ruby_rails_logger, ruby_third_parties_sentry]
   report:
     severity: "critical,high"
     format: json
     output: bearer-results.json

   • Adds scan.disable-domain-resolution and scan.domain-resolution-timeout keys in bearer.yml to control domain resolution behavior during classification.
   • Adds scan.force, scan.quiet, and scan.debug keys in bearer.yml for cache, output verbosity, and debug log control.
   • Adds --config-file flag to the scan command to reference a bearer.yml outside the project directory.

   3 details in Everything

8. docs update Oct 3, 2026 · issue 093

   Bearer CLI's discovery and classification engine documented: 120+ data types, PHIPHIProtected Health Information: individually identifiable health data regulated under the US HIPAA law, whose strict handling requirements drive cyber tools to audit, mask, or restrict access to it. context via --context health, and extensible detectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan a codebase containing health-related data so that attributes like email and first_name are flagged as PHI rather than generic PD.
   copy

   $ bearer scan . --context health

   • Supports --context health flag to instruct Bearer CLI to classify attributes like email or first_name as PHI instead of PD when processing health data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports 120+ data types across sensitive data categories including Personal Data (PD), Sensitive PD, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., and PHI, identified via static code analysis without inspecting actual runtime values.
   • Analyzes data structure definition files including OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., SQL, GraphQL, and Protobuf to discover sensitive data types.
   • Applies a layered classification pipeline using Known Object Patterns, Unknown Object Patterns, Unknown Object Extended Patterns, User Identifier Patterns, Associated Object Patterns, and Known Data Object Patterns to classify discovered data.
   • Allows users to add custom data types, detectors, and classification patterns to extend Bearer CLI's detection coverage.

   5 details in Everything

9. docs update Oct 3, 2026 · issue 093

   Bearer: Adds --report dataflow to bearer scan to produce a JSON report of all personal/sensitive data types, their detectors, file locations, and third-party/database exposures.

   └──▷ TRY IT
   Run a SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. security scan on your codebase to surface CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-tagged violations with file and line context.
   copy

   $ bearer scan . --report security

   Map custom data subjects (e.g. Patient, Employee) instead of the default User when generating a privacy report.
   copy

   $ bearer scan . --report=privacy --data-subject-mapping=/path/to/mappings.json

   Produce a full data-flow breakdown to see every file location where sensitive data is processed or stored, as input for a data catalog.
   copy

   $ bearer scan . --report dataflow

10. docs update Oct 3, 2026 · issue 093

    Bearer: Adds --scanner=sast flag to bearer scan to explicitly invoke the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanner and surface rule violations such as sensitive data in JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage..

    └──▷ TRY IT
    Scan a codebase for hard-coded secrets (passwords, tokens, API keys) before merging a PR.
    copy

    $ bearer scan . --scanner=secrets

11. docs update Oct 3, 2026 · issue 093
    └──▷ TRY IT
    Persist zsh tab completions for Bearer across all new shell sessions on macOS with Homebrew.
    copy

    $ bearer completion zsh > $(brew --prefix)/share/zsh/site-functions/_bearer

12. docs update Oct 3, 2026 · issue 093

    Bearer CLI gains a --report dataflow flag exposing data types, risks, components, and dependencies in structured JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Get a full structured data flow report — data types, risks, components, and dependencies — piped through jq for browsing.
    copy

    $ bearer scan . --report dataflow | jq

    Write the data flow report to a file so another tool or pipeline can consume the JSON output.
    copy

    $ bearer scan . --report dataflow --output output/path/data-flow-report.json

    • Adds --report dataflow flag to bearer scan to produce a structured JSON report covering detected data types, risks, components, and dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The data flow report's data_types section exposes category, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. classification, filename, line/column numbers, field name, object name, and subject name for each detected data type instance.
    • The data flow report's risks section includes detector_id, code location, and the triggering source content for each rule finding in supported languages.
    • The data flow report's components section identifies internal data stores, cloud data stores, and third-party APIs alongside their detection location and detector name.
    • The data flow report's dependencies section lists package manager dependencies with name, version, filename, and detector for each entry.

    5 details in Everything

13. docs update Oct 3, 2026 · issue 093
    └──▷ TRY IT
    Generate a machine-readable privacy report and browse it interactively — useful for an initial GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. data-flow audit.
    copy

    $ bearer scan --report privacy --format json | jq

    Export a CSV privacy report for handoff to a legal or privacy team who will import it into a spreadsheet or data governance platform.
    copy

    $ bearer scan --report privacy --output report.csv

    Apply org-specific data subject labels (e.g. patients, employees) instead of the default User mapping when scanning a healthcare or HR application.
    copy

    $ bearer scan --report privacy --data-subject-mapping /path/to/mappings.json

14. docs update Oct 3, 2026 · issue 093

    Bearer CLI gains a full custom-rule authoring system with YAML config, pattern variables, filters, and an --external-rule-dir flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a scan against your project using custom rules stored in a local directory, in addition to built-in rules.
    copy

    $ bearer scan . --external-rule-dir /path/to/rules/

    Register a custom rules directory persistently so every scan picks it up without a CLI flag.
    bearer.yml copy

    external-rule-dir: /path/to/rules/

    Author a custom rule that detects plain FTP usage carrying sensitive data types, scoped to Ruby.
    /path/to/rules/org_ruby_lang_insecure_ftp.yml copy

    id: org_ruby_lang_insecure_ftp
    description: Do not transmit sensitive data over unencrypted FTP connections.
    languages:
      - ruby
    patterns:
      - pattern: |
          Net::FTP.open() do
            $<DATA_TYPE>
          end
        filters:
          - variable: DATA_TYPE
            detection: datatype
    severity: high
    metadata:
      documentation_url: https://wiki.example.com/policies/ftp

    • Adds only-rule flag/config setting to run only specified custom rules by ID, excluding built-in rules.
    • Supports custom rule YAML files with patterns, sanitizer, languages, trigger, severity, metadata, auxiliary, skip_data_types, and only_data_types keys for authoring organization-specific security rules.
    • Adds match_on: absence trigger with required_detection to detect missing security configurations (e.g. missing forced SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.).
    • Adds data_types_required key to restrict a rule to fire only when sensitive data types are present in the application.
    • Adds pattern variable syntax ($<VARNAME>, $<_>, $<...>, $<!>, $<VARNAME:type>) for flexible ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-aware code matching in custom rules.

    +3 more show less

    • Adds filter keys (values, detection, filename_regex, string_regex, regex, length_less_than, less_than, less_than_or_equal, greater_than, greater_than_or_equal, not, either) to apply conditions to pattern variables.
    • Adds detection: datatype and detection: insecure_url built-in detection filters for matching sensitive data types and plain-HTTP URLs in custom rule patterns.
    • Adds documentation_url metadata key to link custom rules to internal policy documentation in the security report.

    8 details in Everything

15. docs update Oct 3, 2026 · issue 093

    Bearer CLI adds GitLab CI/CD integration with SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. reporting, MR diff scanning, and Reviewdog rdjsonrdjsonA JSON-based format for reporting diagnostic messages (errors, warnings, lints) from static analysis tools, giving cyber tools a machine-readable, interoperable way to surface findings across different editors and CI pipelines. feedback on merge requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scope a CI/CD scan to only findings introduced in a merge request, so pipeline noise is reduced to what the author actually changed.
    .gitlab-ci.yml copy

    bearer:
      only:
        - merge_requests
      image:
        name: bearer/bearer
        entrypoint: [""]
      script:
        bearer scan --diff .

    Surface Bearer findings in GitLab's Security and Compliance dashboard by emitting a SAST artifact that GitLab can ingest.
    .gitlab-ci.yml copy

    bearer:
      image:
        name: bearer/bearer
        entrypoint: [""]
      script:
        - bearer scan . --format gitlab-sast --output gl-sast-report.json
      artifacts:
        reports:
          sast: gl-sast-report.json

    Post inline merge request comments via Reviewdog using Bearer's rdjson output, giving authors immediate, line-level feedback without leaving GitLab.
    .gitlab-ci.yml copy

    bearer_mr:
      only:
        - merge_requests
      script:
        - curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin
        - curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b /usr/local/bin
        - bearer scan . --diff --format=rdjson --output=rd.json || export BEARER_EXIT=$?
        - cat rd.json | reviewdog -f=rdjson -reporter=gitlab-mr-discussion
        - exit $BEARER_EXIT

    • Adds GitLab CI/CD integration via the bearer/bearer Docker image configured in .gitlab-ci.yml using the entrypoint: [""] pattern.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --format gitlab-sast output format and --output gl-sast-report.json to produce a GitLab SAST artifact for the Security and Compliance page.
    • Adds --diff flag support in GitLab CI/CD pipelines to report only findings introduced within a merge request.
    • Adds --format=rdjson output for use with Reviewdog to post inline merge request comments via the gitlab-mr-discussion reporter; requires REVIEWDOG_GITLAB_API_TOKEN set as a project environment variable.

    4 details in Everything

16. docs update Oct 3, 2026 · issue 093

    Bearer GitHub Action adds differential PR scanning, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. upload, Reviewdog PR comments, and Defect Dojo integration via gitlab-sastgitlab-sastGitLab's built-in static analysis feature that scans source code for vulnerabilities during CI/CD pipelines, letting cyber tools integrate findings directly into merge-request workflows without external scanners. format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan only the lines changed in a PR to keep CI feedback focused and fast.
    .github/workflows/bearer.yml copy

    # .github/workflows/bearer.yml
    name: Bearer PR Check
    on:
      pull_request:
        types: [opened, synchronize, reopened]
    permissions:
      contents: read
    jobs:
      rule_check:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v4
          - name: Bearer
            uses: bearer/bearer-action@v2
            with:
              diff: true

    Surface Bearer findings inside GitHub's Security tab by uploading a SARIF report from CI.
    .github/workflows/bearer.yml copy

    # .github/workflows/bearer.yml
    - name: Bearer
      uses: bearer/bearer-action@v2
      with:
        format: sarif
        output: results.sarif
    - name: Upload SARIF file
      if: always()
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: results.sarif

    Push Bearer findings into Defect Dojo for centralised vulnerability management after every merge to main.
    copy

    $ curl -X POST \
      -F 'file=@gl-sast-report.json' \
      -F "product_name=$DD_APP" \
      -F "engagement_name=$DD_ENGAGEMENT" \
      -F 'scan_type=GitLab SAST Report' \
      -H "Authorization: Token $DD_TOKEN" \
      http://example.com/api/v2/import-scan/

    • Adds diff: true input to bearer/bearer-action@v2 to restrict findings to changes introduced within a pull request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds format: sarif and output inputs plus an upload-sarif step to surface Bearer findings in GitHub code scanning's Security tab.
    • Adds format: gitlab-sast output for uploading findings to Defect Dojo via its POST /api/v2/import-scan/ endpoint.
    • Adds api-key input for Bearer Cloud integration in the GitHub Action.
    • Adds bearer-ignore-file, config-file, only-rule, skip-rule, skip-path, scanner, severity, exit-code, hide-progress-bar, quiet, exclude-fingerprint, path, output, and version inputs to bearer/bearer-action@v2 for full CLI-equivalent configuration in CI.

    +2 more show less

    • Exposes exit_code and rule_breaches outputs from the bearer/bearer-action@v2 GitHub Action step for downstream workflow consumption.
    • Adds .github/workflows/bearer.yml as the recommended workflow file path for running Bearer's security report on push to main.

    7 details in Everything

17. docs update Oct 3, 2026 · issue 093

    Bearer: Selects the built-in secrets scanner (in addition to the default SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanner) using the --scanner secrets flag.

    └──▷ TRY IT
    Scan only new findings introduced on a feature branch relative to a specific base branch, avoiding a full codebase rescan in CI.
    copy

    $ git checkout my-feature
    BEARER_DIFF_BASE_BRANCH=main bearer scan --diff .

    Generate a SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. report for upload to GitHub Advanced Security or another SARIF-consuming platform.
    copy

    $ bearer scan --format sarif --output sarif-report.sarif .

    Permanently skip noisy rules across all scans by listing them in bearer.yml instead of repeating --skip-rule on every invocation.
    bearer.yml copy

    skip-rule:
      - ruby_lang_exception
      - ruby_lang_cookies

    • Generates SARIF output via --format sarif paired with --output, for tools that consume the SARIF standard.
    • Generates HTML reports via --format html paired with --output for security and privacy report types.
    • Supports in-code bearer:disable comments to suppress specific rules for an entire block or a single line, in Ruby and JavaScript.

    3 details in Everything

18. v2.1.0 Aug 3, 2026 · release notes

    Bearer v2.1.0 adds language management and refactors ignore logic

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • feat: language management introduces new capability to manage supported languages

    1 detail in Everything

19. v2.0.2 May 18, 2026 · release notes

    Bearer v2.0.2 adds an option to use field name support in scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.2 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v2.0.2

20. v2.0.1 Feb 25, 2026 · release notes

    Bearer v2.0.1 adds a VisitNode function to the rule builder API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v2.0.1

21. v2.0.0 Jan 29, 2026 · release notes

    Bearer v2.0.0 upgrades to go-tree-sitter with improved language grammar support, Python dataflow for default parameters, and language info in dataflow reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Adds dataflow tracking for Python default parameter values, improving data-flow analysis accuracy in Python codebases.
    • Adds language information to the dataflow report output, making it easier to identify which languages are involved in detected flows.
    • Updates engine internals to go-tree-sitter with refreshed language grammars, enabling more file types to be successfully parsed and analyzed.

    3 details in Everything

22. v1.49.0 Feb 19, 2025 · release notes

    Bearer v1.49.0 adds decorator support and reduces noise in scan reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.49.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.49.0

    • Adds decorator support for annotating code patterns in rules.
    • Reduces output verbosity in reports, surfacing fewer low-signal findings.

    2 details in Everything

23. v1.48.0 Jan 6, 2025 · release notes

    Bearer v1.48.0 adds HTTP method to exports and multi-filter value output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.48.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.48.0

    • Adds HTTP method field to exported results, giving practitioners richer API inventory data.
    • Includes matched values when more than one filter is applied, making multi-filter scans more actionable.

    2 details in Everything

24. v1.47.0 Nov 22, 2024 · release notes

    Bearer v1.47.0 adds error reporting to JSON v2 security reports and string value extraction.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.47.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.47.0

    • Adds error details to the JSON v2 security report output.
    • Adds string value extraction support.

    2 details in Everything

25. v1.46.0 Jul 31, 2024 · release notes

    Bearer v1.46.0 adds early pattern-variable error detection and support for multiple required detections in rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.46.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.46.0

    • Errors early when a pattern variable is not found, surfacing misconfigured rule patterns faster.
    • Supports multiple required detections in a single rule, enabling more precise compound detection logic.

    2 details in Everything

26. v1.43.5 May 16, 2024 · release notes

    Adds linux/arm64 binary support for Bearer CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.43.5 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.43.5

27. v1.40.1 Feb 29, 2024 · release notes

    Bearer v1.40.1 adds support for unanchored JavaScript method definitions and anonymous type checking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.40.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.40.1

    • Adds detection coverage for unanchored method_definition in JavaScript source code
    • Adds detection coverage for anonymous types in JavaScript

    2 details in Everything

28. v1.38.0 Feb 12, 2024 · release notes

    Bearer v1.38.0 adds support for const initialization and invocation in Go SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.38.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.38.0

    • feat(golang): handle method_declaration the same as function_declaration for rule matching
    • feat: support const init and const invoke in Go data flow analysis

    2 details in Everything

29. v1.37.0 Jan 29, 2024 · release notes

    Adds unanchored class declaration support for source code analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.37.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.37.0

30. v1.35.0 Jan 16, 2024 · release notes

    Bearer v1.35.0 adds new scan context for GitLab and fixes Azure DevOps URL handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.35.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.35.0

    • feat: add more scan context for gitlab (#1464)

    1 detail in Everything

31. v1.34.0 Jan 9, 2024 · release notes

    Bearer v1.34.0 adds simplified GitLab diff scan configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.34.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.34.0

    • Adds simplified configuration for GitLab diff scans via the gitlab feature.
    • Removes hardcoded application_identity value from the CLI binary.

    2 details in Everything

32. v1.33.0 Dec 12, 2023 · release notes

    Bearer v1.33.0 adds gitlab_pipeline_id support for enhanced CI/CD traceability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.33.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.33.0

    └──▷ USE IT
    Link scan results back to a specific GitLab CI run for auditing.
    shell copy

    bearer scan . --gitlab-pipeline-id $CI_PIPELINE_ID

    • Adds --gitlab-pipeline-id flag to pass the GitLab pipeline identifier into scans

    1 detail in Everything

33. v1.31.0 Nov 22, 2023 · release notes

    Adds jsonv2 output format for security reports via the CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.31.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.31.0

    └──▷ USE IT
    Export findings to a modern, structured JSON format for downstream processing.
    shell copy

    bearer scan --output-format=jsonv2 .

34. v1.30.0 Nov 10, 2023 · release notes

    Bearer v1.30.0 introduces a visual discovery process log to the CLI output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.30.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.30.0

    • Shows the discovery process steps in the terminal during scan execution

    1 detail in Everything

35. v1.29.0 Nov 2, 2023 · release notes

    Bearer v1.29.0 enhances Golang analysis and adds GitLab environment variable fallback support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.29.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.29.0

    • feat: enhance golang support with improved analysis capabilities.
    • feat: use gitlab env vars as fallback to detect CI/CD context when other methods fail.

    2 details in Everything

36. v1.28.0 Oct 25, 2023 · release notes

    Bearer v1.28.0 adds a --fail-on-severity flag for CI enforcement, PHP foreach variable scanning, and CLI completion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.28.0

    └──▷ TRY IT
    Fail a CI pipeline immediately if any findings reach medium severity or higher, preventing high-risk code from merging.
    copy

    $ bearer scan . --fail-on-severity medium

    Generate and source shell completion to speed up CLI interaction in bash or zsh environments.
    copy

    $ bearer completion bash | sudo tee /etc/bash_completion.d/bearer >/dev/null

    • Adds the --fail-on-severity flag to fail builds based on finding severity levels
    • Adds shell completion script generation for supported shells via the completion command
    • Enables scan of variables inside PHP foreach loops in the data flow analysis

    3 details in Everything

37. v1.27.1 Oct 19, 2023 · release notes

    Bearer v1.27.1 adds Beta support for PHP and Alpha support for Python and Go.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.27.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.27.1

    • Adds Beta support for the PHP language with 50 detection rules
    • Adds Alpha support for the Python language with 5 detection rules
    • Adds Alpha support for the Go language with 5 detection rules

    3 details in Everything

38. v1.27.0 Oct 17, 2023 · release notes

    Bearer v1.27.0 adds beta Golang and initial Python support, plus --entropy-greater-than filter

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.27.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.27.0

    └──▷ TRY IT
    Scan a Go project for secrets or vulnerabilities.
    copy

    $ bearer scan ./app --language golang

    Scan Python code specifically.
    copy

    $ bearer scan ./project --language python

    • Adds beta scanning for the Golang language via the existing scan command
    • Adds initial (beta) scanning support for the Python language
    • Adds --entropy-greater-than <value> flag to filter findings by string entropy

    3 details in Everything

39. v1.26.0 Oct 10, 2023 · release notes

    Adds --bearer-cloud-diff flag to Bearer CLI for sending diffscan results directly to Bearer Cloud

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.26.0

    └──▷ TRY IT
    Send only the changes introduced in the current pull request or branch to Bearer Cloud.
    copy

    $ bearer scan . --format sarif --output result.sarif --bearer-cloud-diff

40. v1.25.0 Oct 3, 2023 · release notes

    Bearer v1.25.0 adds a --disable-progress-bar CLI flag and beta PHP bindings support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.25.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.25.0

    └──▷ TRY IT
    Scan code in CI environments where terminal output must be clean and parseable.
    copy

    $ bearer scan --disable-progress-bar .

    • Adds --disable-progress-bar flag to silence progress output for cleaner CI logs
    • Adds beta support for scanning PHP applications via the new PHP bindings

    2 details in Everything

41. v1.24.0 Sep 22, 2023 · release notes

    Adds improved JavaScript expression support and fixes rule disabling behavior.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.24.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.24.0

42. v1.23.0 Sep 18, 2023 · release notes

    v1.23.0 adds --general.log-level/--general.debug flags and syncs ignored findings to Bearer Cloud.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.23.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.23.0

    └──▷ USE IT
    Run a scan with detailed logging output directed to stdout.
    shell copy

    bearer scan . --general.log-level debug

    • Bearer no longer depends on the GitHub API for version checks or rule downloading, resolving rate limiting issues.
    • Adds --general.log-level and --general.debug flags to the bearer scan command to control log verbosity.
    • Added support for uploading ignored findings to Bearer Cloud, enabling centralized management.

    3 details in Everything

43. v1.22.0 Sep 4, 2023 · release notes

    Bearer v1.22.0 adds false_positive status to .bearer/ignore and severity computation details

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.22.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.22.0

    • feat: add false positive status to bearer ignores (#1233)
    • feat: add severity computation details (#1195)

    2 details in Everything

44. v1.21.0 Aug 29, 2023 · release notes

    Adds bearer ignore command family (add, remove, show) and CSV report format output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.21.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.21.0

    • bearer ignore add command to suppress specific findings
    • bearer ignore remove command to unsuppress previously ignored findings
    • bearer ignore show command to display current ignored findings, including --all flag for comprehensive listing
    • ignore migrate subcommand to read configuration from config file during migration
    • --path flag for the ignore command to specify a custom ignore file location

    +1 more show less

    • --format csv flag to export report results in CSV format

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Exit code is now correctly set for all report formats; use --exit-code=0 to override if previous incorrect behavior was relied upon
45. v1.18.0 Aug 2, 2023 · release notes

    Bearer v1.18.0 adds base branch diff scanning, --ignore-failure flag, and new report metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.18.0

    • feat: base branch diff (#1158) enables comparing findings against a base branch.
    • feat: add flag to ignore report failures (#1145) adds a CLI option to prevent non-zero exit codes on empty or filtered reports.
    • feat: add sign-up link to report output (#1159) includes a registration URL in generated reports.
    • feat: show rule count per language (#1156) adds a summary view of applicable rules for each detected language.

    4 details in Everything

46. v1.17.0 Jul 28, 2023 · release notes

    Bearer v1.17 adds scan profiling, fingerprint info in output, and warnings to HTML summary

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.17.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.17.0

    • Adds --profiling flag to enable scan profiling for performance analysis
    • Includes fingerprints information in CLI output via the new fingerprints field
    • Displays warnings within the generated HTML summary report

    3 details in Everything

47. v1.16.0 Jul 4, 2023 · release notes

    Adds more helpful rule validation for Bearer configuration files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.16.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.16.0

    • bearer now validates custom rule configurations at startup, providing clearer error messages when rule syntax or references are incorrect.

    1 detail in Everything

48. v1.15.0 Jun 29, 2023 · release notes

    Adds HTML output format to the CLI scan command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.15.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.15.0

    └──▷ TRY IT
    Generate a human-readable HTML security report from the scan.
    copy

    $ bearer scan ./src --format html

49. v1.14.0 Jun 22, 2023 · release notes

    Bearer v1.14.0 adds dependency checking, rule filters, and improves Java/JS detection patterns

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.14.0

    • Adds dependency-check feature to scan for insecure or outdated dependencies during the scan process
    • Supports using filters when referencing rules to narrow down scan scope (--rule-filters)
    • Adds string assign-equals support for source code pattern matching, enabling detection of assignments using = syntax
    • Improves Java support with better catch block handling and resource block support for more accurate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. analysis

    4 details in Everything

50. v1.13.0 Jun 15, 2023 · release notes

    Adds native multi-core parallel execution and a JS dangerous HTML detection rule in v1.13.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.13.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.13.0

    • dad1b2db leverages all CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores for scanning to improve performance.

    1 detail in Everything

51. v1.12.0 Jun 12, 2023 · release notes

    Adds --profiling flag for performance analysis and expands Java string concatenation detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    • Expands Java TaintedFlow detector to include string concatenation patterns

    1 detail in Everything

52. v1.11.0 Jun 7, 2023 · release notes

    Adds reviewdog output format and data_types to SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    • Adds reviewdog output format for security report via the --format flag (supported values: sarif, json, yaml, reviewdog). Use --output <file> to write results.
    • Adds data_types field to the SaaS report payload to include processed data type information.

    2 details in Everything

53. v1.10.0 Jun 2, 2023 · release notes

    Adds --no-color, --exclude-fingerprints flags and moves the skip rule to documentation in .bearer/config.yaml

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    └──▷ TRY IT
    Scan source code and suppress noisy or known-false-positive findings by their unique ID without modifying source comments
    copy

    $ bearer scan ./src --exclude-fingerprints f1a2b3c4,d5e6f7g8

    Run the scanner in a CI/CD pipeline where color codes would corrupt the log parser
    copy

    $ bearer scan ./repo --no-color

    • Adds --no-color flag to disable colorized output in CLI reports
    • Adds --exclude-fingerprints flag to allow users to exclude specific findings by their fingerprint identifier
    • Moves the skip rule configuration from active defaults to documentation, implying it is now a documented configuration option for controlling scan behavior
    • Improves JavaScript import detection accuracy for loaded libraries

    4 details in Everything

54. v1.9.0 May 30, 2023 · release notes

    Bearer v1.9.0 adds --output sarif_gitlab for GitLab SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. exports and a --scope filter flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    └──▷ USE IT
    Export a SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. report compatible with GitLab's SAST scanner
    shell copy

    bearer scan . --output sarif_gitlab > results.sarif

    Scan only for sources of security vulnerabilities to reduce noise in the output
    shell copy

    bearer scan . --scope sources

    • Adds the new output format sarif_gitlab via the --output flag to export findings in a format suitable for GitLab SAST
    • Adds the --scope CLI flag (subcommand argument) to filter results by rule category (e.g., sinks, sources)

    2 details in Everything

55. v1.8.0 May 23, 2023 · release notes

    Adds official support for shared rules via the shared_rules CLI flag and new CLI arguments for rule selection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • Official support for shared rules in configuration
    • Improves error feedback during Bearer Cloud API uploads

    2 details in Everything

56. v1.7.0 May 17, 2023 · release notes

    Bearer v1.7.0 adds sanitization rule support and TypeScript type matching in JavaScript patterns

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ USE IT
    Configure a custom rule that filters out specific findings using a sanitizer.
    yaml copy

    sanitizer:
      action: filter

    • Adds sanitizer rule capability to sanitize findings from other rules

    1 detail in Everything

57. v1.6.1 May 9, 2023 · release notes

    Adds filename filtering to rules via new filenames field in .bearer/config.yaml

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

58. v1.5.1 May 4, 2023 · release notes

    Bearer v1.5.1 adds Java language support, length_less_than and string regex filters, and a version check disable flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.5.1

    └──▷ USE IT
    Add a new rule using the length filter.
    shell copy

    echo '- name: My Rule\n  filters:\n    - length_less_than: 10' > .bearer/rules.yml

59. v1.4.0 Apr 24, 2023 · release notes

    Bearer v1.4.0 adds KPI version metadata to client meta and enhances OpenAI classification in dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds bearer and rules_version fields to the client_meta payload for KPI tracking
    • Enhances OpenAI-powered classification logic within dependency scanning

    2 details in Everything

60. v1.3.0 Apr 12, 2023 · release notes

    Adds external rule support in Bearer v1.3.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • load rules externally - Rules are now downloaded at startup allowing for updates outside the main binary release cycle

    1 detail in Everything

61. v1.2.0 Apr 5, 2023 · release notes

    Bearer v1.2.0 adds TypeScript detection, external rule loading via --disable-default-rules, and OpenAI data leak rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ TRY IT
    Load a custom rule file without Bearer's built-in rules to avoid conflicts or focus on specific risks.
    copy

    $ bearer scan ./src --disable-default-rules --rules-path custom-rule.yaml

    • Adds --disable-default-rules flag to bearer scan for loading rules externally
    • Enables full TypeScript support using existing JavaScript rules
    • Adds detection for data leaks to open ai via new recipe
    • Sends report automatically when API key is set

    4 details in Everything

62. v1.1.0 Mar 21, 2023 · release notes

    Bearer v1.1.0 adds code comment-based rule skipping and improved JS object destructuring support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds the ability to skip specific security rules using inline code comments within scanned files
    • Improves JavaScript detection engine to correctly handle object destructuring patterns

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The custom rule syntax for triggers has changed, requiring migration via the upgrade documentation
63. v1.0.0 Mar 6, 2023 · release notes

    Bearer v1.0.0 adds --scanner flag to separate secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. from SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and introduces a new security report format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Run only secret scanning without SAST analysis.
    copy

    $ bearer scan --scanner secrets .

    Scan for secrets only in a specific path.
    copy

    $ bearer scan --format jsonlines --scanner secrets ./path/to/src

    • Separates secrets scanning from security (SAST) scanning via the new --scanner flag
    • Renames the summary report to Security report
    • Adds JSON Lines output format support

    3 details in Everything

64. v0.26.0 Feb 28, 2023 · release notes

    Bearer v0.26.0 adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 coverage for Ruby and JavaScript with new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    • Adds support for hardcoded string values in JavaScript detection rules (hardcoded string support)
    • Adds exec with user input detection rule for Ruby applications
    • Adds insecure disabling callback detection rule for Rails applications
    • Adds SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. rule for Express.js using Knex library
    • Adds dangerous eval detection rule for general JavaScript analysis

    +6 more show less

    • Enriches the existing eval user input rule with better detection context
    • Adds Rails render to path rule for directory traversal prevention
    • Adds AWS Lambda SQL injection rule (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-89) for JavaScript functions
    • Adds AWS OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. rule (CWE-78) for JavaScript/Node.js
    • Adds Express UI redress / clickjacking detection rule
    • Adds Express sendFile with request data rule for path traversal prevention

    11 details in Everything

65. v0.25.0 Feb 24, 2023 · release notes

    Bearer v0.25.0 adds not/regex filters, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 coverage boosts, and new detector rules for JS/Ruby

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    • Adds not and regex filters for rule filtering
    • Extends OWASP Top 10 coverage on Ruby and JavaScript with new detection rules (e.g., CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-601, CWE-548, DeserializationDeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., Path Traversal)
    • Adds detector support for Algolia, Airbrake, Bugsnag, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor., New Relic, Segment (JavaScript), ClickHouse, Google Analytics (Ruby), Datadog, Honeybadger, Rollbar, Elasticsearch, and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.
    • Includes CWE IDs in summary output for newer JS rules

    4 details in Everything

66. v0.24.0 Feb 13, 2023 · release notes

    Bearer v0.24.0 adds Javascript scanning alpha support and Warning severity level for non-breaking rule violations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    └──▷ USE IT
    Generate a compliance-focused privacy report including subject and third-party inventory for legal audits.
    shell copy

    bearer scan . --report curio-privacy-report

    • Adds Javascript alpha scanning support with initial rules including JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. validation, file generation checks, exception handling patterns, and weak encryption detection.
    • Introduces the Warning severity level for less critical rules that do not break CI/CD pipelines, allowing teams to track issues without halting deployments.
    • Adds Ruby logger integrations for Bugsnag, Honeybadger, Rollbar, Airbrake, Scout APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause., and Open Telemetry detection rules.
    • Expands analytics environment support to detect Algolia, Elasticsearch, and Segment integrations within the scanned codebase.
    • Adds Curio Privacy Report capabilities including subject name to datatype mapping, subjects inventory, and third-party inventory reports for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification./CCPA/HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. compliance.

    5 details in Everything

67. v0.23.0 Feb 6, 2023 · release notes

    Adds Rule terminology and New Relic sensitive data detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    • Renames the concept of Policy to Rule across CLI commands and output formats.
    • Adds detection for sensitive data leaking in New Relic Loggers.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The term Policy is renamed to Rule in CLI commands and output formats, which may require updates to scripts expecting the previous terminology.
68. v0.22.0 Jan 13, 2023 · release notes

    Bearer v0.22.0 adds secret leak detection, custom detector/policy directories, and recipe exclusion patterns

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.22.0

    • Adds support for secret leaks in policies to detect sensitive data exposure.
    • Adds dirs configuration keys for loading custom detectors and policies from specified paths.
    • Enables exclusion patterns when using wildcards in recipes to fine-tune file matching.
    • Extends the built-in Ruby custom detector to cover IO.open file operations.

    4 details in Everything

69. v0.21.0 Dec 23, 2022 · release notes

    Bearer v0.21.0 adds encrypted column detection via encrypted_ prefix and skips Git-ignored files by default.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    • Adds encrypted_ column prefix to mark SQL detections as encrypted in the analysis output
    • Changes behavior to skip files that are ignored by .gitignore during scanning

    2 details in Everything

70. v0.20.1 Dec 21, 2022 · release notes

    Bearer v0.20.1 adds --homebrew install option and includes database info in policy reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.20.1

    • Includes database information in the placeholder output of policy reports.

    1 detail in Everything

71. v0.19.0 Dec 15, 2022 · release notes

    Bearer v0.19.0 adds policy report external service counts and optimized dataflow analysis via caching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    └──▷ TRY IT
    Scan your codebase and inspect the generated policies report JSON to see how many external services are referenced in detected violations.
    copy

    $ bearer scan . --format json | jq '.policies[].external_service_count'

    • Adds external_service_count field to the policies report placeholder output for tracking dependency usage

    1 detail in Everything

72. v0.17.0 Dec 15, 2022 · release notes

    Bearer v0.17.0 adds weak encryption and weak password length policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    • new-policies: Add support for weak_encryption detection policy to identify use of cryptographically weak algorithms.

    1 detail in Everything

73. v0.16.0 Dec 14, 2022 · release notes

    Bearer v0.16.0 adds password encryption policy and improves scan progress logs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    • feat(policies): add password encryption policy
    • feat: improve scan progress logs

    2 details in Everything

74. v0.15.0 Dec 8, 2022 · release notes

    Adds rails cookie leaks and insecure FTP data transfer detection policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    • Adds rails cookie leaks policy to detect sensitive data exposure in Rails applications
    • Adds policy for detecting communication of data categories over insecure FTP

    2 details in Everything

75. v0.14.0 Dec 7, 2022 · release notes

    Adds Ruby policy for third-party data exposure and insecure HTTP data category communication

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • Adds feat for communicating data category via insecure HTTP detection logic

    1 detail in Everything

76. v0.13.0 Dec 6, 2022 · release notes

    Adds a new policy rule for detecting insecure HTTP GET requests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

77. v0.12.0 Dec 6, 2022 · release notes

    Bearer v0.12.0 adds Ruby policies for insecure FTP and unenforced SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    • Adds Ruby policy detection for insecure FTP when sensitive data is processed
    • Adds Ruby policy detection for insecure communication where SSL is not enforced

    2 details in Everything

78. v0.11.1 Dec 2, 2022 · release notes

    Adds support for disabling SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification in Bearer v0.11.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.1 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.11.1

79. v0.11.0 Dec 2, 2022 · release notes

    Bearer v0.11.0 adds detection policies for insecure Rails SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. and HTTP GET data transmission.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Adds policy to detect Rails applications sending email via insecure (non-TLS) SMTP connections
    • Adds policy to detect applications transmitting sensitive data in HTTP GET request parameters or URLs

    2 details in Everything

80. v0.10.0 Dec 1, 2022 · release notes

    Adds Rails sessions and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. leak detection policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ TRY IT
    Scan a Ruby on Rails app for insecure session configurations using the new built-in policy.
    copy

    $ bearer scan --policies rails_sessions .

    Check Rails codebase for potential JWT secret leaks with the dedicated detection rule.
    copy

    $ bearer scan --policies rails_jwt_leaks .

    • Adds rails_sessions policy for detecting insecure Rails session configurations
    • Adds rails_jwt_leaks policy for detecting hardcoded or misconfigured JWT secrets in Rails applications

    2 details in Everything

81. v0.9.0 Nov 29, 2022 · release notes

    Bearer v0.9.0 adds CI-integrated exit codes for policy breaches and an HTTP dataflow rule

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ USE IT
    Fail the CI build immediately when a policy violation is found in the scanned repository
    shell copy

    bearer scan . --policy-dir policies; if [[ $? -ne 0 ]]; then echo "Policy breach detected"; exit 1; fi

    • Returns exit status 1 when policy breaches are detected, enabling CI pipelines to fail on findings

    1 detail in Everything

82. v0.8.0 Nov 28, 2022 · release notes

    Bearer v0.8.0 adds application-level encryption support and policy report formatting enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    └──▷ USE IT
    Run Bearer to check for missing application-level encryption in your codebase
    shell copy

    bearer scan --policy=application-level-missing-encryption ./src

    View policy breaches with summary counts and tabulated severity grouping
    shell copy

    bearer scan --format=policy-report --output=./report.json ./src

    • Adds application level encryption feature to detect missing encryption configurations
    • Adds a dedicated policy for detecting "application level missing encryption" scenarios
    • Supports ellipsis syntax in configuration or rule definitions via new ellipsis support

    3 details in Everything

83. v0.7.0 Nov 23, 2022 · release notes

    Bearer v0.7.0 adds UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to recipes and includes them and classified frameworks in the dataflow report

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Adds UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. generation for recipes, enabling unique identification of each recipe instance

    1 detail in Everything

84. v0.6.0 Nov 22, 2022 · release notes

    Bearer v0.6.0 adds CLI policy flags and risk severity by data category

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Adds --policy and related policy flags to the CLI for controlling scan behavior
    • Enables reporting of risk severity based on data category classification

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Object-level data types are no longer exported (stop exporting object-level data types)
85. v0.5.0 Nov 16, 2022 · release notes

    Bearer v0.5.0 adds status output for scan progress monitoring

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/Bearer/bearer.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0