Cacomi vs Quixxi Scan
Cacomi
cacomi-app.comQuixxi Scan
quixxi.comSide by side
| Figure | Cacomi | Quixxi Scan |
|---|---|---|
| Price from | $0.83/mo | $24.92/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| macOS | Yes | — |
| iOS | — | Yes |
| Android | — | Yes |
| Plans published | 5 | 10 |
| Spec score · Mobile Application Security Testing Software | 8.4 (#2) | 7.8 (#9) |
| Intended users | The privacy policy says Cacomi is intended for developers and professional users and is not directed to children. | The partner page describes the services as intended for mobile app developers and organizations with significant numbers of mobile app users. |
| Product | Cacomi scans source code and app binaries for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues. | Quixxi Scan provides static and dynamic security assessments of mobile apps with recommendations to address vulnerabilities. |
Plans
Cacomi
- Cacomi Security – Monthly$2.99 a month
- Cacomi Pro – Monthly$4.99 a month
- Cacomi Lifetime$8.99, paid once
- Cacomi Security – Annual$9.99 a year
- Cacomi Pro – Annual$39.99 a year
Quixxi Scan
- API Scan — One-off$29, paid once
- SAST Scan — One-off$29, paid once
- API Scan — Monthly$49 a month
- SAST Scan — Monthly$49 a month
- DAST Scan — One-off$199, paid once
- API Scan — Yearly$299 a year
- Shield — One-off$399, paid once
- SAST Scan — Yearly$499 a year
- Shield — Monthly$599 a month
- Shield — Yearly$5,999 a year
In their own words
Cacomi
Cacomi is a macOS, self-hosted static analysis tool for developers reviewing source code and application builds. It scans source and binaries for unused code, risky logs, hardcoded secrets, insecure URLs, weak cryptography, insecure storage, TLS problems, WebView misuse, injection and taint flows. It covers native iOS and Android, Flutter, and Python backends using Django, Flask or FastAPI. Binary checks accept IPA, APP and APK files, including permissions and privacy metadata. Cacomi also identifies AI service calls, possible data exposure to AI providers, prompt handling, and embedded AI or machine-learning models in an AI BOM. Analysis runs locally; the policy says code, binaries, results and reports are processed on-device and not intentionally uploaded. Reports export as PDF, SARIF and JSON for named CI systems, with findings mapped to OWASP mobile standards or ASVS. Plans include $2.99 a month for Security, $4.99 a month for Pro, $8.99, paid once Lifetime, $9.99 a year Security, and $39.99 a year Pro.
Quixxi Scan
Quixxi Scan assesses Android and iOS app security through static and dynamic analysis, with recommendations for addressing vulnerabilities. SAST analyzes apps to identify risks, explain them and suggest fixes; automated continuous scanning can be integrated into a CI/CD pipeline. DAST examines app behavior, including SSL pinning, root detection, sensitive data, endpoint identity, encryption, copy and paste, and screenshots. A separate API Scan checks for issues such as injection attacks, authentication flaws, cross-site scripting and insecure direct object references. The service runs in the cloud and is available on Android, iOS and the web. The site offers a free SAST trial and a free app scan link, but does not state a trial duration. One-off SAST and API scans cost $29 as a one-time purchase; DAST costs $199, paid once. Monthly SAST and API scans cost $49 a month. The pricing article says there is no unlimited monthly DAST plan, and custom plans can be based on selected apps and modules. Quixxi says the product aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements and incorporates NIST practices.