Quixxi Scan vs SEBASTiAn

Quixxi Scan assesses Android and iOS app security through static and dynamic analysis, with recommendations for addressing vulnerabilities. SAST analyzes apps to identify risks, explain them and suggest fixes; automated continuous scanning can be integrated into a CI/CD pipeline. DAST examines app behavior, including SSL pinning, root detection, sensitive data, endpoint identity, encryption, copy and paste, and screenshots. A separate API Scan checks for issues such as injection attacks, authentication flaws, cross-site scripting and insecure direct object references. The service runs in the cloud and is available on Android, iOS and the web. The site offers a free SAST trial and a free app scan link, but does not state a trial duration. One-off SAST and API scans cost $29 as a one-time purchase; DAST costs $199, paid once. Monthly SAST and API scans cost $49 a month. The pricing article says there is no unlimited monthly DAST plan, and custom plans can be based on selected apps and modules. Quixxi says the product aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements and incorporates NIST practices.

SEBASTiAn is a self-hosted tool for static security assessment of Android APK and iOS IPA applications. It runs on Linux, macOS, and Windows, and can generate a unified JSON report with vulnerabilities, remediation suggestions, further reading, and the location of vulnerable code or configuration. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The project describes the tool as modular and extensible, and offers running it from source or using its official Docker image. The command-line option --generate-report saves identified vulnerabilities as JSON, with reports available in English or Italian. The default analysis timeout is 1,200 seconds, and users can change it. Installation guidance requires Python 3 and CMake; Python 3.12 or later may require manually installing LIEF. The AGPL-3.0 open-source plan is free for open-source projects. Commercial or closed-source use requires a commercial license, with pricing not listed.