Bearer vs Semgrep Code
Bearer
bearer.com
Semgrep Code
semgrep.devSide by side
| Figure | Bearer | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 7 |
| Spec score · Static Application Security Testing Sast | 7.7 (#11) | 8.7 (#2) |
| Spec score · SAST Tools | 7.7 (#15) | 8.7 (#3) |
| Spec score · Static Application Security Testing Software | 7.7 (#17) | 8.7 (#2) |
| Installation | Installation options include an install script, Homebrew, Linux package managers, Docker, and downloadable binaries; macOS 12 or later is supported and Git 2.34 or later is required. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
Bearer
Bearer CLI is a free static application security testing tool for Linux and macOS. It scans source code and analyzes data flows to identify security and privacy risks while analyzing code patterns instead of viewing actual data values. The tool supports more than 120 sensitive data types, including personal data, PII, and PHI. Privacy reports can show sensitive data, related data subjects, and internal or third-party components that process it, with information useful for GDPR records of processing activities. Security features include SAST rules and a separate hard-coded-secrets scanner. Bearer documents pull-request and CI/CD use with GitHub Actions, GitLab CI/CD, and CircleCI, plus custom security rules. Listed stacks include Go, Python, PHP, JavaScript, TypeScript, Ruby, and Java. Installation options include scripts, Homebrew, Linux package managers, Docker, and binaries. macOS 12 or later and Git 2.34 or later are required.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.