Skip to content
SPECIFICTION
Get listed

SEBASTiAn

github.com

Free plan WindowsmacOSLinux
Visit github.com
Spec score 7.5 #13 of 21 in Mobile Application Security Testing Software

What it is

SEBASTiAn is a self-hosted tool for static security assessment of Android APK and iOS IPA applications. It runs on Linux, macOS, and Windows, and can generate a unified JSON report with vulnerabilities, remediation suggestions, further reading, and the location of vulnerable code or configuration. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The project describes the tool as modular and extensible, and offers running it from source or using its official Docker image. The command-line option --generate-report saves identified vulnerabilities as JSON, with reports available in English or Italian. The default analysis timeout is 1,200 seconds, and users can change it. Installation guidance requires Python 3 and CMake; Python 3.12 or later may require manually installing LIEF. The AGPL-3.0 open-source plan is free for open-source projects. Commercial or closed-source use requires a commercial license, with pricing not listed.

Spec sheet

Purpose
SEBASTiAn is a static, extensible, platform-agnostic tool for assessing mobile application security.Read 7 Oct 2026 · github.com
Maker
Talos Security identifies itself as a Genoa-based innovative SME founded in 2016 as a spin-off of the University of Genoa.Read 7 Oct 2026 · talos-sec.com
Analysis checks
Its Android checks cover issues including insecure networking, cryptography, permissions, exported components, and WebView configuration.Read 7 Oct 2026 · github.com
Analysis limit
The default analysis timeout is 1,200 seconds, and users can set a different timeout.Read 7 Oct 2026 · github.com
Compatibility note
The README says Python 3.12 or later may require manually installing LIEF because stable prebuilt wheels are unavailable.Read 7 Oct 2026 · github.com
Extensibility
The project describes SEBASTiAn as extensible and modular.Read 7 Oct 2026 · github.com
iOS checks
Its iOS checks include binary encryption and signature, insecure APIs and TLS settings, weak cryptography, and memory-protection flags.Read 7 Oct 2026 · github.com
Language support
The command line offers English and Italian as vulnerability-report languages.Read 7 Oct 2026 · github.com
Mobile targets
It analyzes Android APK and iOS IPA applications.Read 7 Oct 2026 · github.com
Output option
The command-line option --generate-report saves identified vulnerabilities as a JSON file.Read 7 Oct 2026 · github.com
Platform requirements
The README lists Ubuntu, Windows, and macOS installation guidance and requires Python 3 and CMake.Read 7 Oct 2026 · github.com
Project support
The maintainers welcome questions, bug reports, and pull requests on GitHub.Read 7 Oct 2026 · github.com
Publication
The project README links to a 2023 SoftwareX paper about SEBASTiAn.Read 7 Oct 2026 · github.com
Reports
It can produce a unified JSON report with vulnerabilities, remediation suggestions, further-reading links, and the location of vulnerable code or configuration.Read 7 Oct 2026 · github.com
Run options
The tool can be run from source or from its Docker image, and the repository links to an official Docker Hub image.Read 7 Oct 2026 · github.com

Plans and prices

AGPL-3.0 open-source license Free For open-source projects Read 7 Oct 2026 · github.com
Commercial license Priced on request Required for commercial use or closed-source projects; contact [email protected] Read 7 Oct 2026 · github.com

Every SEBASTiAn plan and price →

Strong points and limits

Strong points

  • Analyzes Android APK and iOS IPA files
  • Reports vulnerabilities with remediation suggestions
  • Includes checks across Android and iOS security areas
  • Runs from source or an official Docker image
  • Supports English and Italian reports

Limits

  • Does not perform dynamic app analysis
  • Requires Python 3 and CMake
  • Python 3.12 or later may require manual LIEF installation

Who it suits

It suits developers and security teams assessing Android and iOS app binaries with static checks. Open-source projects can use the AGPL-3.0 plan; commercial or closed-source projects need a commercial license.

Verdict

SEBASTiAn provides platform-specific static checks and reports that point to vulnerable code or configuration. Its static-only scope, setup requirements, and separate commercial licensing matter when choosing it.

Where Specifiction places it

Alternatives to SEBASTiAnAll alternatives →