Bearer CLI

Bearer CLI Integration with DefectDojo

Bearer CLI is a open-source static analysis tool with a focus that sets it apart from most SAST scanners: it finds not only security vulnerabilities in code, but also where sensitive data flows — identifying how personal information, credentials, and regulated data move through an application's codebase. For teams building data-intensive applications or operating under privacy regulations like GDPR, HIPAA, or CCPA, Bearer CLI surfaces the intersection of security and data risk in a way that vulnerability-only scanners miss. Like all point-in-time scanners, though, Bearer CLI findings are only as useful as what happens after the scan. Integrating Bearer CLI with DefectDojo moves those findings into a persistent lifecycle — deduplicated, tracked, assigned, and reportable across scan cycles — giving security and privacy teams the workflow they need to manage both security and data risk systematically across an entire application portfolio.

Why Bearer CLI Matters

Bearer CLI occupies a distinctive position in the application security tooling landscape by combining SAST vulnerability detection with data flow analysis that most security scanners don't attempt.

• Bearer CLI performs data flow analysis to identify where sensitive data types — PII, financial data, health information, authentication credentials — are handled in the codebase, and surfaces security issues specifically in those data flows. A SQL injection risk in a code path that processes credit card numbers carries different urgency than one that processes non-sensitive data; Bearer CLI makes that distinction explicit.
• Its rule set covers OWASP Top 10 vulnerabilities, CWE-mapped security issues, and a dedicated category of data leakage risks — including sensitive data logged to output, transmitted without encryption, exposed in API responses, or stored insecurely
• Bearer CLI supports multiple languages and frameworks out of the box — Ruby, JavaScript, TypeScript, Python, Java, Go, and PHP — making it practical for polyglot teams without per-language scanner sprawl
• Privacy risk reporting is built in: Bearer CLI can generate reports categorized by data type (PII, PHI, financial data) and by risk level, giving privacy and compliance teams a security-tool-generated view of data handling risk without requiring a separate data catalog tool
• Output is available in JSON and SARIF formats, both of which DefectDojo can ingest, making import straightforward without preprocessing
• As an open-source tool with an active development community, Bearer CLI integrates into CI/CD pipelines with a single binary install and is configurable via a .bearer YAML configuration file for rule tuning and data type customization

Advantages of This Integration

Bearer CLI surfaces security and data risk in code. DefectDojo gives both categories of findings the lifecycle management that a security program requires.

• Persistent finding records across scan cycles: Each time Bearer CLI scans a codebase, reimporting into DefectDojo updates existing findings rather than generating a new unconnected record set. Security and privacy findings persist across scan cycles with age tracking, remediation history, and SLA status — none of which are available from Bearer CLI's native output formats between runs.
• Unified security and privacy finding management: Bearer CLI's security vulnerability findings and its data leakage / privacy risk findings land in the same DefectDojo product alongside findings from other scanners. Security teams manage both categories in a single workflow; privacy and compliance teams get a view of data risk findings filtered to their domain — without separate tooling for each.
• SLA enforcement for both security and data risk findings: DefectDojo applies configurable SLA policies by severity across all imported Bearer CLI findings. Critical security vulnerabilities get tight remediation targets; High severity data leakage findings in regulated data flows get appropriate urgency. Breach tracking surfaces overdue items in dashboards automatically.
• False positive management that persists across reimports: Bearer CLI produces false positives, particularly for data flow findings where the actual data type may be misidentified or the risk context doesn't match the finding's framing. Findings marked as false positives in DefectDojo are retained across reimports — the next Bearer CLI scan won't re-open them, and the documented rationale is available for compliance review.
• Cross-repository portfolio visibility for privacy risk: Security teams with multiple applications handling personal data get aggregated metrics across their entire portfolio in DefectDojo — open data leakage and privacy findings by severity, data type, age, and SLA status — without manually reviewing per-repository scan outputs. This aggregate view is what drives privacy remediation prioritization and compliance reporting.
• Developer-facing remediation tickets with data context: Triaged Bearer CLI findings push from DefectDojo to Jira, GitHub Issues, or ServiceNow with vulnerability type, affected file and line, the sensitive data type involved, and remediation guidance — giving developers the context they need to understand both the security issue and the data risk without requiring access to security tooling.
• Compliance evidence for privacy regulations: DefectDojo's engagement history and finding lifecycle records provide documented evidence of security and data risk scanning activity — useful for demonstrating due diligence under GDPR Article 25 (data protection by design), HIPAA technical safeguard requirements, and CCPA security obligations.

How This Integration Works

Bearer CLI produces JSON and SARIF output via its CLI that DefectDojo can ingest directly.

Step 1 — Install Bearer CLI and run a scan

Install Bearer CLI:

# macOS / Linux via curl

curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh

# Or via Homebrew

brew install bearer/tap/bearer

Run a scan and capture JSON output:

# Scan a project directory with JSON output

bearer scan ./src --format json --output bearer-results.json

# Scan with only security rules (exclude privacy rules)

bearer scan ./src \

--format json \

--output bearer-security.json \

--only-rule=ruby_rails_logger,javascript_lang_sql_injection

# Scan with SARIF output (alternative format)

bearer scan ./src --format sarif --output bearer-results.sarif

# Scan targeting a specific severity threshold

bearer scan ./src \

--format json \

--output bearer-results.json \

--severity critical,high,medium

# Scan with custom configuration file

bearer scan ./src \

--format json \

--output bearer-results.json \

--config-file .bearer/config.yml

For CI pipeline integration:

# Run scan and capture output regardless of exit code

bearer scan ./src --format json --output bearer-results.json || true

# GitHub Actions example step

- name: Run Bearer CLI scan

run: bearer scan ./src --format json --output bearer-results.json || true

- name: Upload Bearer results

uses: actions/upload-artifact@v3

with:

name: bearer-results

path: bearer-results.json

Step 2 — Import into DefectDojo

Use Bearer CLI as the scan type for JSON output, or SARIF for SARIF format:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Bearer CLI" \

-F "file=@bearer-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring scans

For repositories scanned on a regular CI/CD cadence, use the reimport endpoint to update existing findings rather than accumulate redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Bearer CLI" \

-F "file=@bearer-results.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new scan as resolved, creates records for new findings, and leaves previously false-positived or risk-accepted findings untouched.

Data Granularity: What Gets Imported

Use Cases

For applications handling regulated personal data: A healthcare software company runs Bearer CLI across its patient portal and API services — Ruby on Rails and Node.js applications that handle PHI. Bearer CLI identifies PHI flowing into logs, being transmitted over non-TLS connections in internal service calls, and exposed in verbose API error responses. These findings import into a dedicated DefectDojo engagement for data security, separate from general SAST findings, with HIPAA-aligned SLA targets and assignment to both the engineering team and the privacy officer for oversight. The engagement record provides documented evidence of data security scanning activity for HIPAA technical safeguard compliance.

In a CI/CD pipeline for a consumer-facing web application: Bearer CLI runs on every merge to main for a SaaS application handling user PII. Results import into DefectDojo, where security findings (SQL injection, XSS, insecure deserialization) are assigned to engineering with standard SLA targets and data leakage findings (PII logged to Sentry, email addresses in debug output) are flagged for both engineering and the privacy team. The dual-audience routing — security findings to one team, privacy findings to another — is managed through DefectDojo's assignment model without requiring separate tooling for each category.

During a GDPR Article 25 compliance review: A European software company needs to demonstrate data protection by design as part of a GDPR compliance audit. Bearer CLI scans the codebase and surfaces where personal data is collected, processed, and stored. Results import into a DefectDojo engagement scoped to the compliance review period. Data leakage findings are triaged with legal and engineering jointly — accepted findings get documented rationale in DefectDojo, remediated findings get verified closure in subsequent reimports. The engagement record is the primary compliance evidence artifact for the Article 25 review.

For a polyglot microservices architecture security baseline: An organization with microservices in Ruby, Python, Go, and JavaScript runs Bearer CLI across all services in a nightly pipeline. DefectDojo aggregates findings across services by language and data type, giving the security team a portfolio view of where data security risk is concentrated — whether it's primarily a logging hygiene issue, an encryption gap, or a specific vulnerability class — and which language ecosystems are generating the most findings. This aggregate intelligence drives training priorities and framework-level remediation decisions.

Operational Tips

• Separate security and privacy findings into distinct DefectDojo engagements: Bearer CLI findings that represent exploitable vulnerabilities (SQL injection, XSS, insecure deserialization) and findings that represent data leakage or privacy risk (PII in logs, sensitive data in API responses) have different remediation owners, different urgency profiles, and often require different approval chains. Splitting them into separate engagements — or at minimum tagging them differently — keeps triage and assignment clean.
• Use --severity filtering to control import volume: Bearer CLI's full output on large codebases can include Warning-level findings that are informational observations rather than actionable security issues. Filtering to critical,high,medium for the primary DefectDojo import and handling Warning findings on a separate slower cadence keeps your active finding queue focused on remediable risk.
• Use || true in CI to prevent pipeline blocking on findings: Bearer CLI exits non-zero when findings are present. In CI pipelines where Bandit output should be captured and imported into DefectDojo regardless of findings, use || true (or equivalent) to prevent the scan stage from failing the build before the import step can run. Handle gate logic — failing builds on new Critical findings — as a post-import step.
• Tune data type detection with custom configuration before large-scale import: Bearer CLI's data type detection can misclassify variable names as sensitive data types in codebases with domain-specific naming conventions. Running a configuration tuning pass with the .bearer/config.yml file — adjusting data type patterns, adding false positive rules — before importing at scale reduces the triage burden from misclassified data flow findings.
• Tag findings by data type and regulatory framework on import: DefectDojo's tagging system allows findings to be tagged with the sensitive data category (PII, PHI, FinancialData) and the relevant regulatory framework (GDPR, HIPAA, CCPA). These tags enable privacy-team filtering of their relevant findings from the broader security finding set without requiring separate products or engagements for each regulatory domain.
• Pair Bearer CLI with a secrets scanner for complete credential coverage: Bearer CLI detects hardcoded credentials and insecure credential handling patterns, but its primary strength is data flow analysis rather than exhaustive secrets scanning. Pairing Bearer CLI with a dedicated secrets scanner (Trufflehog, Gitleaks, Detect Secrets) and importing both into DefectDojo under the same or adjacent engagements gives more complete coverage of credential exposure risk than either tool provides alone.
• Document data flow risk acceptances with privacy officer sign-off: For data leakage findings that are accepted as risk — for example, a logging pattern that includes user identifiers for audit trail purposes — capture the privacy officer's sign-off as the approver in DefectDojo's risk acceptance workflow. This documents not just that the risk was accepted but by whom and with what justification, which is exactly what a GDPR or HIPAA auditor will look for.