Show HN: Bearer – Open-source code security scanning solution (SAST)

Re:Show HN: Bearer – Open-source code security scanning solu... by scinerio on Tuesday March 07, 2023 @12:21PM (#35058101)

How does this compare with Semgrep, which to my understanding is the dominating open-source SAST offering to date?

[ Parent | on HN ]

Re:Show HN: Bearer – Open-source code security scanning solu... by gmontard on Tuesday March 07, 2023 @12:26PM (#35058177)

I wouldn't say dominating tbh, but clearly one of the good solution out there for sure.

Probably the biggest differentiator is our ability to detect sensitive data flows and map those to the different security findings. It allows finding unique risks as sensitive data leaking in loggers for example, but also dynamically prioritize issues based on the type of sensitive data at risks or even decide it's not important if none are.

Let's say you're connecting to an unsecure API, we're going to assess if you're sending sensitive data or not there, depending on that we'll change the priority of the risk. If none are involved it would be a low risk, if PHI are involved it would be critical.

For the rest, I let you be the judge of the UX, quality of findings, speed etc.

[ Parent | on HN ]

Re:Show HN: Bearer – Open-source code security scanning solu... by scinerio on Tuesday March 07, 2023 @12:36PM (#35058316)

Interesting! Thanks for responding. Sounds like it's bridging SAST and threat modeling.

[ Parent | on HN ]