Cacomi vs Reversense Security

Cacomi is a macOS, self-hosted static analysis tool for developers reviewing source code and application builds. It scans source and binaries for unused code, risky logs, hardcoded secrets, insecure URLs, weak cryptography, insecure storage, TLS problems, WebView misuse, injection and taint flows. It covers native iOS and Android, Flutter, and Python backends using Django, Flask or FastAPI. Binary checks accept IPA, APP and APK files, including permissions and privacy metadata. Cacomi also identifies AI service calls, possible data exposure to AI providers, prompt handling, and embedded AI or machine-learning models in an AI BOM. Analysis runs locally; the policy says code, binaries, results and reports are processed on-device and not intentionally uploaded. Reports export as PDF, SARIF and JSON for named CI systems, with findings mapped to OWASP mobile standards or ASVS. Plans include $2.99 a month for Security, $4.99 a month for Pro, $8.99, paid once Lifetime, $9.99 a year Security, and $39.99 a year Pro.

Reversense Security analyzes mobile and embedded application binaries without requiring source code or manual reverse engineering. It can assess binaries and packaged apps from app stores or CI/CD pipelines, using IAST and fuzzing to uncover exploitable vulnerabilities and runtime attack paths. Its Dexcalibur engine combines static, dynamic, and symbolic analysis for deobfuscation and tailored investigations, including highly obfuscated apps. An integrated Dalvik virtual machine supports symbolic and concrete execution of bytecode that needs implicit context. Teams can monitor application-level network traffic, including HTTPS, without changing device network settings or bypassing SSL pinning; they can also monitor and tamper with application-level NFC commands. Multiple devices and apps can be instrumented within one project. Other functions include automated privacy reports for Android and iOS against GDPR, CRA, PCI, and CCPA referentials, and digital forensics to find where mobile apps store identity information. The free Dexcalibur Community Edition costs nothing and supports Android instrumentation generation and dynamic deobfuscation.