Product · MAST

In the garage.
On the road.

Mobile Application Security Testing checks your iOS and Android app twice: the code before it ships, and how it behaves on a real phone. Every finding comes with a fix your developers can merge.

Scan your appSee how it works
IN THE GARAGE · INFO.PLIST <key>NSAllowsArbitraryLoads</key> <true/> <key>PAYMENTS_KEY</key> <string>sk_live_9f2…</string> ON THE ROAD · DEVICE TRAFFIC POST http://api.acme.app/login email=ana@…&password=hunter2 200 OK GET /v2/accounts Plain HTTP allowed. Everywhere. Live key, shipped to every phone. Password in the clear. High. GREEN AGENT · FIX READY - ArbitraryLoads: true + ArbitraryLoads: false

What MAST means

One app.
Three ways in.

Like inspecting a car in the garage and then taking it for a test drive. Nandee reads the app, runs it, and checks every part it was built from, then puts it all in one report.

In the garage · SASTReads the appCode and compiled builds, before anything runs: secrets left in the app, risky settings, and weak encryption.See SAST → On the road · DASTRuns the appInstalled on a real device and used like a person would: what it stores, what it sends, and what it leaves behind.See DAST → The parts list · SCAChecks every partEvery open-source library and SDK inside the app, checked for known problems and license risks.See SCA / OSS →

What it catches

Problems only
a phone has.

Checks follow the OWASP MASVS, the industry standard for mobile app security.

  • MASVS-STORAGE

    Data left on the device

    Tokens, personal data, and health or card details stored where other apps or a backup can read them.

  • MASVS-NETWORK

    Weak talk with servers

    Plain HTTP, certificate checks switched off, and data sent to places it shouldn't go.

  • MASVS-RESILIENCE

    Easy to tamper with

    Checks that only run on the phone, debug builds in the store, and logic a modified app can skip.

  • MASVS-CRYPTO

    Secrets in the app

    API keys, passwords, and weak encryption that anyone can pull out of a downloaded build.

  • MASVS-AUTH

    Logins that don't hold

    Sessions that outlive logout, biometric unlock that can be skipped, and tokens that never expire.

  • MASVS-PLATFORM

    Open doors into the app

    Deep links, intents, WebViews, and screens other apps can reach without asking.

How it works

Upload a build.
Get fixes back.

  1. 1ConnectUpload an IPA, APK, or AAB, or link your CI so every build is checked.
  2. 2Inspect and driveSAST and SCA read the app. DAST runs it on a device and watches.
  3. 3TriageAI Triage drops the false alarms and puts the real risks first.
  4. 4FixGreen Agent writes the change in Swift, Kotlin, Dart, or JavaScript, ready to merge.
SESSIONSTORE.SWIFT:42 · SAST + DASTHigh

Refresh token saved where backups can read it

Found in the code, then confirmed on a device: the token sits in UserDefaults and lands in every unencrypted backup. 

42  - UserDefaults.standard.set(token, forKey: "refresh")
42  + try Keychain.set(token, key: "refresh", access: .thisDeviceOnly)
Fix ready · Green Agent

When you need it

Your app holds something worth taking.

You ship a mobile app that handles user accounts, payments, or personal data.

  • iOSSwift, Objective-C
  • AndroidKotlin, Java
  • React NativeJavaScript, TypeScript
  • FlutterDart

Fair questions.

How is MAST different from SAST and DAST?

MAST is mobile app testing as a whole. SAST, DAST, and SCA are the three ways Nandee does it, and you get one report instead of three.

Do you need our source code?

No. SAST can read the compiled IPA or APK. With source, findings point to exact lines and Green Agent can write the fix in place.

How long does a scan take?

Most apps finish in under 15 minutes. Very large codebases can take up to an hour. You get a notification when results are ready.

Does Nandee protect the app while it runs?

No. Nandee doesn't add code inside your app. It finds the problems and writes the fixes before you release, so there's nothing left to shield.

Test the app your users carry.

Scan your app