Cacomi vs SEBASTiAn

Cacomi is a macOS, self-hosted static analysis tool for developers reviewing source code and application builds. It scans source and binaries for unused code, risky logs, hardcoded secrets, insecure URLs, weak cryptography, insecure storage, TLS problems, WebView misuse, injection and taint flows. It covers native iOS and Android, Flutter, and Python backends using Django, Flask or FastAPI. Binary checks accept IPA, APP and APK files, including permissions and privacy metadata. Cacomi also identifies AI service calls, possible data exposure to AI providers, prompt handling, and embedded AI or machine-learning models in an AI BOM. Analysis runs locally; the policy says code, binaries, results and reports are processed on-device and not intentionally uploaded. Reports export as PDF, SARIF and JSON for named CI systems, with findings mapped to OWASP mobile standards or ASVS. Plans include $2.99 a month for Security, $4.99 a month for Pro, $8.99, paid once Lifetime, $9.99 a year Security, and $39.99 a year Pro.

SEBASTiAn is a self-hosted tool for static security assessment of Android APK and iOS IPA applications. It runs on Linux, macOS, and Windows, and can generate a unified JSON report with vulnerabilities, remediation suggestions, further reading, and the location of vulnerable code or configuration. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The project describes the tool as modular and extensible, and offers running it from source or using its official Docker image. The command-line option --generate-report saves identified vulnerabilities as JSON, with reports available in English or Italian. The default analysis timeout is 1,200 seconds, and users can change it. Installation guidance requires Python 3 and CMake; Python 3.12 or later may require manually installing LIEF. The AGPL-3.0 open-source plan is free for open-source projects. Commercial or closed-source use requires a commercial license, with pricing not listed.