Vulkro vs Bearer

Bearer is the SAST tool that made "data-flow first" a category. Instead of CVSS-ordered findings, Bearer scores by the sensitive data type a vulnerability touches: PII, PHI, payment data, and so on. That framing is genuinely useful, and a deliberate influence on how Vulkro thinks about privacy-class findings.

So when do you pick Vulkro over Bearer?

At a glance​

Benchmark — Tier 1 corpus​

(Locked numbers ship in CHANGELOG.public.md on each release; reproducible via bench/comparison/run.sh --tier1 --tools vulkro,bearer.)

The architectural distinction​

Both tools take a "never upload source" stance, so the split is narrower than vs Semgrep AppSec Platform or Snyk. The decision hinges on:

• License model. Bearer CLI is Elastic License 2.0: free for in-house use; you can't offer Bearer as a hosted service to third parties. Bearer Pro adds an explicit commercial license for that case. Vulkro is closed-source-detectors, per-term license, no auto-renewal: a $19 monthly or $149 annual pass that expires and STOPS, instead of auto-billing.

• Coverage shape. Bearer is data-type-first; the rule pack is organised around what the code TOUCHES (email, phone, health record). Vulkro is OWASP-API-first; the rule pack is organised around what the code EXPOSES (BOLA, BFLA, mass assignment, SSRF, etc.). Both surfaces matter; pick the one that matches your team's mental model.

• Verification surface. Vulkro publishes the benchmark harness and the ground-truth corpus (bench/comparison/ groundtruth/). Bearer's precision numbers come from internal measurement that isn't externally reproducible.

When to pick Bearer​

• Your audit posture is data-protection-first — GDPR, CCPA, HIPAA reports are the deliverable.
• You have a Ruby / Elixir / VB.Net codebase Bearer Pro covers but Vulkro doesn't.
• You're comfortable with ELv2 license terms (free in-house, paid if you re-host).

When to pick Vulkro​

• Your audit posture is OWASP-API-first, with privacy as one of several axes (Vulkro emits PII/PHI findings, just not as the organising principle).
• You want CVE / SCA in the same scan rather than a separate Bearer tier.
• You're auditing an Apex / Salesforce codebase (Bearer doesn't cover Apex; Vulkro does).
• You want a per-term license that doesn't auto-renew — the contrast with SaaS billing is a positioning advantage when your procurement team has been burned by renewal surprises.

What we kept from Bearer's playbook​

Two ideas in Bearer are good enough to take inspiration from:

1. Data-flow priority on PII findings. Vulkro's security::pii and security::phi detectors emit findings whose severity is shaped by the data type, mirroring Bearer's data-flow-first approach for that specific category.
2. Per-finding confidence and remediation text. Bearer's compact remediation snippets influenced how Vulkro renders vulkro explain <ID> output.

The credit lines up; the moat is elsewhere (CVE bundle, OWASP API completeness, reproducible benchmark, no-auto-renewal license).

Try both side by side​

# In your project root:
vulkro scan . --format sarif > vulkro.sarif
bearer scan . --output bearer.sarif --report security

# Diff in your favourite SARIF viewer.

Both tools emit SARIF; GitHub Code Scanning ingests either format.

See also: Vulkro vs Semgrep, Vulkro vs Snyk, Safety, CVE bundle changelog.