Product · DAST

Runs your app.
Watches what it does.

Code tells you what an app might do. DAST installs your build, signs in, walks the screens, and records what it actually stores, sends, and leaves behind.

Scan your appBook a demo
LIVE TRAFFIC · WALLET-ANDROID GET /v2/me 200 GET /v2/cards 200 POST http://t.acme.app/e 200 GET /v2/feed 200 POST /v2/logout 204 GET /v2/me 200 GET /v2/feed 200 POST /v2/cards/freeze 200 Telemetry over plain HTTP. Email in the body. Logged out. Still works. FIX · SESSIONSTORE.SWIFT HIGH - logout() clears the UI + logout() revokes, wipes Keychain

What it watches

What the app does
when nobody's looking.

  • Network

    Everything that leaves the phone

    Cleartext requests, weak TLS, skipped certificate checks, and data sent where it shouldn't go.

  • Storage

    What it writes while running

    Files, databases, caches, and keychain entries created during a real session.

  • Sessions

    How long a login really lasts

    Token lifetime, logout that actually logs out, and sessions that can be replayed.

  • Entry points

    Doors other apps can knock on

    Deep links, intents, and URL schemes, sent the input nobody planned for.

  • Screens

    What's visible by accident

    Card numbers in app-switcher snapshots, and secrets left on the clipboard.

  • Logs

    What the running app says out loud

    Tokens and personal data in the device log, as it happens.

Every finding maps to OWASP MASVSSTORAGEAUTHNETWORKPLATFORMPRIVACY

Example finding

The logout button that doesn't.

HighDASTMASVS-AUTH-1 · CWE-613Auth/SessionStore.swift:58

Session token still valid after logout

Nandee logged out, then replayed the old token. The server answered as if nothing happened. Anyone who copied that token keeps the account.

Evidence, recorded at runtime
09:41:02  POST /v2/logout        204
09:41:05  GET  /v2/me
          Authorization: Bearer eyJhbGci…
09:41:05  200 {"email": "j***@acme.app"}

Three seconds after logout. Still in.

Suggested fix
58  func logout() async throws {
59    try await api.revoke(session.refreshToken)
60    try Keychain.delete("refresh_token")
61    session = nil
62  }

Revoke on the server, then forget it here.

Where DAST fits

  1. 01ConnectUpload a build or link CI
  2. 02 · This pageReadSAST, DAST, and SCA
  3. 03TriageFalse positives out, ranked
  4. 04 · Early accessAttack pathsRed Agent chains findings
  5. 05FixGreen Agent writes it
  6. 06 · EnterpriseReviewPeople sign off

Fair questions.

Do you need test accounts?

For screens behind sign-in, yes. Credentials are encrypted in a secrets vault, used only during your scans, and never shown to anyone in plain text. We recommend dedicated test accounts, and you can rotate or revoke them from your dashboard at any time.

Will it touch production?

No, not by default. DAST runs against a staging or test build you provide. If you want production coverage, we agree the scope, timing, and rate limits with you in writing first.

Is this the same as runtime protection?

No. DAST runs your app to test it, then you fix what it finds. Nothing from Nandee ships inside your app.

Find out what your app does after dark.

Scan your app