Bearer vs CodeSonar

Bearer CLI is a free static application security testing tool for Linux and macOS. It scans source code and analyzes data flows to identify security and privacy risks while analyzing code patterns instead of viewing actual data values. The tool supports more than 120 sensitive data types, including personal data, PII, and PHI. Privacy reports can show sensitive data, related data subjects, and internal or third-party components that process it, with information useful for GDPR records of processing activities. Security features include SAST rules and a separate hard-coded-secrets scanner. Bearer documents pull-request and CI/CD use with GitHub Actions, GitLab CI/CD, and CircleCI, plus custom security rules. Listed stacks include Go, Python, PHP, JavaScript, TypeScript, Ruby, and Java. Installation options include scripts, Homebrew, Linux package managers, Docker, and binaries. macOS 12 or later and Git 2.34 or later are required.

CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.