Bearer - Sensitive Data Flow & SAST Cheatsheet
Bearer is an open-source static application security testing tool with a distinctive angle: it is built around sensitive data flow. Rather than only matching vulnerable code patterns, Bearer discovers where PII, PHI, and other sensitive data live in your codebase, maps how that data moves, and flags when it leaks into logs, third-party services, or insecure communication. That makes it unusually well suited to privacy and compliance work (GDPR, HIPAA, PCI) alongside conventional security scanning.
Installation
Scanning
| Command | Description |
|---|
bearer scan . | Full security + privacy scan |
bearer scan . --scanner secrets | Secret detection only |
bearer scan . --scanner sast | SAST rules only |
bearer scan . --report dataflow | Show sensitive data flows |
bearer scan . --report privacy | Privacy/compliance report |
bearer scan . --format json -o out.json | JSON output |
Report Types
| Report | Shows |
|---|
security (default) | Rule violations by severity |
dataflow | Where sensitive data is detected and where it goes |
privacy | Data subjects/types per third-party component |
stats | Codebase composition summary |
# Which third parties receive personal data?
bearer scan . --report privacy --format json
Sensitive Data Detection
| Category | Examples |
|---|
| Personal | Name, email, phone, address |
| Financial | Card numbers, bank accounts |
| Health (PHI) | Diagnoses, medical identifiers |
| Credentials | Passwords, tokens, keys |
| Device/tracking | IPs, device IDs |
Bearer classifies data by type and subject (customer, employee, user), which is what makes the privacy report meaningful.
Common Findings
| Finding | Risk |
|---|
| PII written to logs | Data leakage into log aggregation |
| Sensitive data to third party | Unvetted processor / GDPR issue |
| Unencrypted transmission | Data over HTTP |
| Weak crypto | Insecure algorithms on sensitive fields |
| Secrets in source | Hardcoded credentials |
Severity & Filtering
| Flag | Effect |
|---|
--severity critical,high | Only report these levels |
--skip-path "tests/**,vendor/**" | Exclude paths |
--only-rule RULE_ID | Run a single rule |
--skip-rule RULE_ID | Suppress a rule |
--exit-code 1 | Fail CI on findings |
Configuration
# bearer.yml
scan:
skip-path:
- "**/tests/**"
- "**/node_modules/**"
severity:
- critical
- high
report:
format: json
CI Integration
# Gate a PR on high-severity data-flow issues
bearer scan . --severity critical,high --exit-code 1
# Produce SARIF for GitHub code scanning
bearer scan . --format sarif -o bearer.sarif
Custom Rules
Bearer rules are YAML and can define new sensitive patterns or detections:
| Field | Purpose |
|---|
patterns | Code shapes to match |
languages | Applicable languages |
severity | Finding severity |
metadata.cwe_id | Map to CWE |
Bearer vs Other SAST
| Aspect | Bearer | Semgrep/Opengrep | TruffleHog |
|---|
| Core idea | Sensitive data flow | Pattern/taint rules | Secret scanning |
| Privacy reporting | First-class | No | No |
| Compliance mapping | GDPR/HIPAA/PCI | Manual | No |
| Best for | Data-risk + privacy review | General SAST breadth | Leaked credentials |
Complements Semgrep/Opengrep for general SAST and TruffleHog for secrets — Bearer’s edge is knowing what data is at risk.
Resources
