Oversecured vs SEBASTiAn

Oversecured is an offensive security platform for mobile apps that combines static, dynamic, and interactive application testing with AI-assisted triage. Android static analysis can use APK, AAB, or APKS files without Android source code; iOS static analysis requires Swift source code. The site says it covers more than 175 Android and 85 iOS vulnerability types. Dynamic testing runs apps in a controlled environment, fuzzes deep links and exported components, and provides proofs of concept, stack traces, recordings, and reproduction steps. Interactive testing can use a configured test account to examine protected flows such as payments, account settings, and private content. Integrations include CLI, MCP, REST API, CI/CD, and webhooks, while role-based access and SSO for Microsoft Entra ID and Google Workspace are available. Hacker costs $500, paid once, billed per scan; Business costs $1,000 a month, billed per app. Enterprise pricing is custom and includes on-prem deployment and regional hosting. A limited five-week pilot is offered free with no commitment.

SEBASTiAn is a self-hosted tool for static security assessment of Android APK and iOS IPA applications. It runs on Linux, macOS, and Windows, and can generate a unified JSON report with vulnerabilities, remediation suggestions, further reading, and the location of vulnerable code or configuration. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The project describes the tool as modular and extensible, and offers running it from source or using its official Docker image. The command-line option --generate-report saves identified vulnerabilities as JSON, with reports available in English or Italian. The default analysis timeout is 1,200 seconds, and users can change it. Installation guidance requires Python 3 and CMake; Python 3.12 or later may require manually installing LIEF. The AGPL-3.0 open-source plan is free for open-source projects. Commercial or closed-source use requires a commercial license, with pricing not listed.