Freedom251 › Mobile Application Security Testing Software
Cacomi
What Cacomi is
Cacomi is a macOS static analysis tool for developers reviewing source code and app builds. It scans code and binaries for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues. It covers native iOS and Android projects, Flutter projects, and Python backends built with Django, Flask or FastAPI. Binary scans can examine IPA, APP and APK files for issues such as exposed secrets, risky permissions and privacy metadata problems.
The scanner also identifies AI service calls, prompt handling, possible data exposure to AI providers, and embedded AI or ML models, then gathers those findings in an AI BOM inventory. Unused-code findings use language-specific parsing, three-level reference counting and a confidence score. Secret checks cover source, configuration and binary strings, with detected values masked. Cacomi processes code, binaries, scan results and reports on-device, according to its privacy policy, and says the app does not intentionally upload them. Reports can be exported as PDFs, SARIF or JSON for pipelines such as GitHub Actions, GitLab CI, Bitrise and Azure DevOps. Mobile findings map to OWASP MASVS and MASTG; Python findings map to OWASP ASVS. Cacomi is a pre-release static analysis tool, and its maker says it does not replace dynamic testing, penetration testing, manual review or certification.
Who it suits
Cacomi suits developers who want to check code and builds locally during development, including teams working on mobile apps, Flutter projects or Python backends. It can complement deeper security testing tools with static findings and pipeline exports.
What it does well
- Processes source code, binaries and reports on-device.
- Covers native iOS, Android, Flutter and Python projects.
- Scans IPA, APP and APK binaries.
- Exports PDF, SARIF and JSON findings.
- Maps mobile and Python findings to OWASP standards.
- Students can get Pro free for one year with a student email.
What to know first
- Available for macOS.
- Pre-release static analysis may produce false positives or miss issues.
- Does not replace dynamic testing, penetration testing, manual review or certification.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Cacomi Security – Monthly | Monthly · Security plan | $2.99 a month |
| Cacomi Pro – Annual | Annual · Pro plan | $39.99 a year |
| Cacomi Pro – Monthly | Monthly · Pro plan | $4.99 a month |
| Cacomi Lifetime | Lifetime purchase | $8.99, paid once |
| Cacomi Security – Annual | Annual · Security plan | $9.99 a year |
As cacomi-app.com lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Cacomi website.
- Use a Mac to run the macOS tool.
- Choose a listed monthly, annual or lifetime plan, or use the free plan.
- Students can register with a student email for one year of Cacomi Pro free.
- Export PDF reports or SARIF and JSON findings for a supported pipeline.
Verdict
Choose Cacomi if you develop on a Mac and want local static checks across mobile apps, Flutter projects or Python backends. Look elsewhere or pair it with deeper testing if you need dynamic analysis, penetration testing, manual review or certification.
Questions
Is Cacomi free?
Cacomi has a free plan. Students can receive Cacomi Pro free for one year after registering with a student email.
What does Cacomi cost?
Listed plans are Security at $2.99 a month or $9.99 a year; Pro at $4.99 a month or $39.99 a year; and Lifetime at $8.99, paid once.
Which platforms and projects does it support?
Cacomi runs on macOS and analyzes native iOS and Android projects, Flutter projects, and Python backends using Django, Flask or FastAPI. It scans IPA, APP and APK files.
Does Cacomi upload source code or scan results?
Its privacy policy says source code, binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app.
Can Cacomi replace penetration testing or certification?
No. Its maker describes Cacomi as a pre-release static analysis tool that does not replace dynamic testing, penetration testing, manual review or official certification.
How can findings be used in CI?
Cacomi exports findings in SARIF and JSON for pipelines including GitHub Actions, GitLab CI, Bitrise, Azure DevOps and local pipelines.
Facts from Cacomi's own pages
- AI detection
- It identifies AI service calls, possible data exposure to AI providers, prompt handling and embedded AI or ML models, and collects findings in an AI BOM. · cacomi-app.com, 7 Oct 2026
- AI inventory
- It detects AI service calls, potential data exposure to AI providers and embedded AI or ML models, and collects findings in an AI BOM inventory. · cacomi-app.com, 7 Oct 2026
- Automation
- It exports findings as SARIF and JSON for GitHub Actions, GitLab CI, Bitrise, Azure DevOps and local pipelines. · cacomi-app.com, 7 Oct 2026
- Backend support
- Python backend checks cover Django, Flask and FastAPI and map findings to OWASP ASVS. · cacomi-app.com, 7 Oct 2026
- Binary scanning
- It scans .ipa, .app and .apk files, including iOS Mach-O and Android DEX and ELF details. · cacomi-app.com, 7 Oct 2026
- Code cleanup
- Unused-code detection uses per-language parsing, three-level reference counting and a confidence score for each finding. · cacomi-app.com, 7 Oct 2026
- Intended users
- The privacy policy says Cacomi is intended for developers and professional users and is not directed to children. · cacomi-app.com, 7 Oct 2026
- Limits
- Cacomi is a pre-release static analysis tool that may produce false positives or miss issues and does not replace dynamic testing, penetration testing, manual review or certification. · cacomi-app.com, 7 Oct 2026
- Local analysis
- The maker says analysis runs locally on your Mac; its privacy policy says source code, binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app. · cacomi-app.com, 7 Oct 2026
- Local safety
- The feature page says analysis runs locally, archive extraction is hardened against path traversal and zip bombs, and destructive actions show a preview before confirmation. · cacomi-app.com, 7 Oct 2026
- Mobile and backend coverage
- Cacomi analyzes native iOS and Android projects, Flutter projects and Python backends. · cacomi-app.com, 7 Oct 2026
- Privacy
- The privacy policy says source code, app binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app. · cacomi-app.com, 7 Oct 2026
- Privacy and purchases
- The privacy policy says Apple handles payment and subscription processing for purchases through the Mac App Store, and may provide limited transaction information to validate paid access. · cacomi-app.com, 7 Oct 2026
- Product
- Cacomi scans source code and app binaries for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues. · cacomi-app.com, 7 Oct 2026
- Reports
- Cacomi exports PDF reports with severity, confidence, evidence and remediation per finding, with secrets masked. · cacomi-app.com, 7 Oct 2026
- Reports and CI
- Cacomi exports PDF reports and findings in SARIF and JSON for pipelines including GitHub Actions, GitLab CI, Bitrise and Azure DevOps. · cacomi-app.com, 7 Oct 2026
- Secret handling
- Secret detection covers source, configuration and binary strings, and the maker says detected values remain masked. · cacomi-app.com, 7 Oct 2026
- Security limits
- Cacomi is a pre-release static analysis tool; the maker says it does not replace dynamic testing, penetration testing, manual review or official certification. · cacomi-app.com, 7 Oct 2026
- Standards mapping
- Mobile findings map to OWASP MASVS, MASTG and related standards, while Python findings map to OWASP ASVS. · cacomi-app.com, 7 Oct 2026
- Static security
- Its mobile static checks cover weak cryptography, insecure storage, cleartext or disabled TLS, WebView misuse, injection and taint flows. · cacomi-app.com, 7 Oct 2026
- Student offer
- The homepage offers students Cacomi Pro free for one year after registering with a student email. · cacomi-app.com, 7 Oct 2026
- Support contact
- The privacy policy lists [email protected] for questions about privacy practices. · cacomi-app.com, 7 Oct 2026
- Who it is for
- The maker describes Cacomi as a local scanner for developers checking code and builds during development, alongside deeper testing tools. · cacomi-app.com, 7 Oct 2026