Freedom251 › Mobile Application Security Testing Software
Q-mast
What Q-mast is
Q-mast is Quokka’s mobile app security testing product for teams that want to assess iOS and Android apps during development. It analyzes compiled app binaries without needing source code, including obfuscated, protected, and signed builds. Its methods combine static and dynamic analysis with interactive and forced-path execution, and it can observe app behavior on non-rooted, non-jailbroken devices.
For supply-chain review, Q-mast creates version-specific software bills of materials and analyzes SDK behavior, vulnerable dependencies, and risky third-party code. It checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF. Quokka says scans take less than 60 minutes and produce less than 1% false results.
The product page lists connections to GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, as well as API support for CI/CD and DevSecOps integration. Quokka describes Q-mast as a way for developers to add security testing to the software development lifecycle. It is a paid product with pricing on request, and prospective customers can request a personalized demo. Quokka states that it is SOC 2 compliant; its SOC 2 report is available by contacting the company.
Who it suits
Q-mast suits development teams that want to add automated security checks for iOS and Android apps to their software development lifecycle. It is also suited to teams reviewing compiled or obfuscated app builds and mobile software supply-chain components.
What it does well
- Analyzes compiled binaries without requiring source code.
- Supports obfuscated, protected, and signed builds.
- Combines static, dynamic, interactive, and forced-path analysis.
- Generates version-specific software bills of materials.
- Lists integrations including GitHub, GitLab, Jenkins, and Snyk.
What to know first
- Pricing is available on request.
- The stated mobile app analysis covers iOS and Android.
Getting started
- Visit the Q-mast product page.
- Request a personalized demo from Quokka.
- Ask Quokka for pricing.
- Use the listed API or integrations to connect Q-mast with development workflows.
Verdict
Choose Q-mast if your development team needs mobile app security analysis across compiled builds, app behavior, and dependencies. Teams seeking a stated price will need to request pricing from Quokka.
Questions
How much does Q-mast cost?
Q-mast is paid, and pricing is available on request.
Which mobile platforms does Q-mast analyze?
Q-mast analyzes iOS and Android apps.
Does Q-mast need an app’s source code?
No. It analyzes compiled app binaries without requiring source code.
Which integrations are listed?
The product page lists GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, along with API support for CI/CD and DevSecOps integration.
Who makes Q-mast?
Q-mast is a Quokka product. Quokka lists offices in San Jose, California, and Arlington, Virginia.
Can customers access support materials?
Quokka directs customers to log in with customer credentials to access its knowledge base library.
Facts from Q-mast's own pages
- Analysis methods
- Q-mast combines static, dynamic, interactive, and forced-path execution analysis. · quokka.io, 7 Oct 2026
- API
- The product page lists API support for CI/CD and DevSecOps integration. · quokka.io, 7 Oct 2026
- Binary scanning
- It analyzes compiled app binaries without requiring source code, including obfuscated builds. · quokka.io, 7 Oct 2026
- Binary support
- It analyzes compiled, obfuscated binaries and scans protected and signed builds. · quokka.io, 7 Oct 2026
- Device testing
- The product page says Q-mast observes app behavior on non-rooted, non-jailbroken devices. · quokka.io, 7 Oct 2026
- Founded
- 2011 · quokka.io, 28 Sept 2026
- Headquarters
- Quokka lists offices in San Jose, California, and Arlington, Virginia. · quokka.io, 7 Oct 2026
- Integrations
- The product page lists GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk integrations or connections. · quokka.io, 7 Oct 2026
- Intended users
- Quokka presents Q-mast for teams testing mobile apps they build and for DevSecOps teams integrating app testing into CI/CD workflows. · quokka.io, 7 Oct 2026
- Pricing
- The Q-mast product page directs prospective customers to request a personalized demo; it does not state a price. · quokka.io, 7 Oct 2026
- Protected builds
- Quokka says Q-mast supports protected and signed builds, including signed iOS builds. · quokka.io, 7 Oct 2026
- Purpose
- Q-mast is an automated mobile app security testing solution that analyzes iOS and Android apps without requiring source code. · quokka.io, 7 Oct 2026
- SBOM
- Q-mast generates version-precise software bills of materials and analyzes SDK behavior and vulnerable dependencies. · quokka.io, 7 Oct 2026
- Scan speed
- Quokka says scans take less than 60 minutes and report less than 1% false results. · quokka.io, 7 Oct 2026
- Scan time
- Quokka says scans take less than 60 minutes and report less than 1% false results. · quokka.io, 7 Oct 2026
- Security
- Quokka states that it is SOC 2 compliant. · quokka.io, 7 Oct 2026
- Security assurance
- Quokka says it achieved SOC 2 compliance and that its SOC 2 report is available by contacting the company. · quokka.io, 7 Oct 2026
- Standards
- Quokka says Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF. · quokka.io, 7 Oct 2026
- Supply chain
- It generates version-precise SBOMs and analyzes SDK behavior, vulnerable dependencies, and risky third-party code. · quokka.io, 7 Oct 2026
- Support
- Quokka directs customers to log in with customer credentials to access its knowledge base library. · quokka.io, 7 Oct 2026