Skip to content
SPECIFICTION
Get listed

Q-mast

quokka.io

iOSAndroidAPI
Visit quokka.io
Spec score 7.1 #16 of 21 in Mobile Application Security Testing Software

What it is

Q-mast is an automated security testing solution for iOS and Android applications. It analyzes compiled binaries without source code, including obfuscated, protected, and signed builds. Static, dynamic, interactive, and forced-path execution methods are combined, with behavior observed on non-rooted and non-jailbroken devices. Quokka says scans take less than 60 minutes and report less than 1% false results. Q-mast creates version-precise software bills of materials and examines SDK behavior, vulnerable dependencies, and risky third-party code. Checks cover NIAP, NIST, OWASP MASVS, CVEs, and SARIF. Listed connections include GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, with API support for CI/CD and DevSecOps integration. Quokka positions it for developers adding security testing to the software development lifecycle. Pricing is on request, and a personalized demo is available. Quokka states that Q-mast is SOC 2 compliant.

Spec sheet

Purpose
Q-mast is an automated mobile app security testing solution that analyzes iOS and Android apps without requiring source code.Read 7 Oct 2026 · quokka.io
Intended users
Quokka presents Q-mast for teams testing mobile apps they build and for DevSecOps teams integrating app testing into CI/CD workflows.Read 7 Oct 2026 · quokka.io
API
The product page lists API support for CI/CD and DevSecOps integration.Read 7 Oct 2026 · quokka.io
Integrations
Quokka lists GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk integrations for Q-mast.Read 7 Oct 2026 · quokka.io
Security
Quokka states that it is SOC 2 compliant.Read 7 Oct 2026 · quokka.io
Support
Quokka directs customers to log in with customer credentials to access its knowledge base library.Read 7 Oct 2026 · quokka.io
Headquarters
Quokka lists offices in San Jose, California, and Arlington, Virginia.Read 7 Oct 2026 · quokka.io
Founded
2011Read 28 Sep 2026 · quokka.io
Analysis methods
Q-mast combines static, dynamic, interactive, and forced-path execution analysis.Read 7 Oct 2026 · quokka.io
Binary scanning
It analyzes compiled app binaries without requiring source code, including obfuscated builds.Read 7 Oct 2026 · quokka.io
Binary support
It analyzes compiled, obfuscated binaries and scans protected and signed builds.Read 7 Oct 2026 · quokka.io
Device testing
The product page says Q-mast observes app behavior on non-rooted, non-jailbroken devices.Read 7 Oct 2026 · quokka.io
Pricing
The Q-mast product page directs prospective customers to request a personalized demo; it does not state a price.Read 7 Oct 2026 · quokka.io
Protected builds
Quokka says Q-mast supports protected and signed builds, including signed iOS builds.Read 7 Oct 2026 · quokka.io
SBOM
Q-mast generates version-precise software bills of materials and analyzes SDK behavior and vulnerable dependencies.Read 7 Oct 2026 · quokka.io
Scan speed
Quokka says scans take less than 60 minutes and report less than 1% false results.Read 7 Oct 2026 · quokka.io
Scan time
Quokka says scans take less than 60 minutes and report less than 1% false results.Read 7 Oct 2026 · quokka.io
Security assurance
Quokka says it achieved SOC 2 compliance and that its SOC 2 report is available by contacting the company.Read 7 Oct 2026 · quokka.io
Standards
Quokka says Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF.Read 7 Oct 2026 · quokka.io
Supply chain
It generates version-precise SBOMs and analyzes SDK behavior, vulnerable dependencies, and risky third-party code.Read 7 Oct 2026 · quokka.io

Strong points and limits

Strong points

  • Scans compiled binaries without source code
  • Combines static and dynamic analysis methods
  • Generates version-precise software bills of materials
  • Supports listed CI/CD and DevSecOps connections
  • Analyzes non-rooted and non-jailbroken devices

Limits

  • Pricing is available only on request
  • Customer credentials are required for knowledge-base access
  • Only iOS and Android mobile platforms are listed

Who it suits

Q-mast suits developers adding mobile-app security checks to their development lifecycle. It is aimed at teams working with iOS and Android binaries, including protected builds.

Verdict

Q-mast focuses on source-independent mobile binary analysis, supply-chain review, and development-tool integrations. Teams must request pricing and use the listed mobile platforms.

Where Specifiction places it

Alternatives to Q-mastAll alternatives →