Cacomi
What it is
Cacomi is paid macOS software for local static analysis of source code and app binaries. It scans for unused code, risky logs, hardcoded secrets, insecure URLs, insecure storage, weak cryptography, permissions issues, and other security findings. Coverage includes native iOS and Android projects, Flutter projects, and Python backends using Django, Flask, or FastAPI. It can inspect IPA, APP, and APK files, detect AI service calls and possible data exposure, and organize embedded AI or ML model findings in an AI BOM. Unused-code analysis uses language-specific parsing, three-level reference counting, and confidence scores. Secret detection covers source, configuration, and binary strings, with detected values masked. Analysis runs on the Mac; the privacy policy says code, binaries, results, and reports are processed on-device and not intentionally uploaded. Reports export to PDF, SARIF, and JSON for named CI pipelines. Plans include $2.99 a month for Security, $4.99 a month for Pro, annual plans, and an $8.99 lifetime purchase.
For and against
For
- Local on-device analysis
- Mobile, Flutter, and Python coverage
- AI findings organized in an AI BOM
- PDF, SARIF, and JSON exports
- Student Pro offer for one year
Against
- Pre-release tool may miss issues
- Does not replace dynamic or penetration testing
- macOS software only
- No dynamic app analysis
The verdict
Cacomi combines local code and binary scanning with mobile, backend, AI, and CI reporting features. Its pre-release status and static-only scope mean it should complement deeper security testing rather than replace it.
Who it suits
Cacomi suits developers and professional users reviewing mobile, Flutter, or Python projects during development. It is for static checks alongside, not instead of, dynamic testing and manual review.
Plans and prices
Cacomi Security – Monthly
Security plan
Read 7 Oct 2026 · apps.apple.com
Cacomi Pro – Monthly
Pro plan
Read 7 Oct 2026 · apps.apple.com
Cacomi Lifetime
Lifetime purchase
Read 7 Oct 2026 · apps.apple.com
Cacomi Security – Annual
Security plan
Read 7 Oct 2026 · apps.apple.com
Cacomi Pro – Annual
Pro plan
Read 7 Oct 2026 · apps.apple.com
On the record
- AI detection
- It identifies AI service calls, possible data exposure to AI providers, prompt handling and embedded AI or ML models, and collects findings in an AI BOM.cacomi-app.com · read 7 Oct 2026
- AI inventory
- It detects AI service calls, potential data exposure to AI providers and embedded AI or ML models, and collects findings in an AI BOM inventory.cacomi-app.com · read 7 Oct 2026
- Automation
- It exports findings as SARIF and JSON for GitHub Actions, GitLab CI, Bitrise, Azure DevOps and local pipelines.cacomi-app.com · read 7 Oct 2026
- Backend support
- Python backend checks cover Django, Flask and FastAPI and map findings to OWASP ASVS.cacomi-app.com · read 7 Oct 2026
- Binary scanning
- It scans .ipa, .app and .apk files, including iOS Mach-O and Android DEX and ELF details.cacomi-app.com · read 7 Oct 2026
- Code cleanup
- Unused-code detection uses per-language parsing, three-level reference counting and a confidence score for each finding.cacomi-app.com · read 7 Oct 2026
- Intended users
- The privacy policy says Cacomi is intended for developers and professional users and is not directed to children.cacomi-app.com · read 7 Oct 2026
- Limits
- Cacomi is a pre-release static analysis tool that may produce false positives or miss issues and does not replace dynamic testing, penetration testing, manual review or certification.cacomi-app.com · read 7 Oct 2026
- Local analysis
- The maker says analysis runs locally on your Mac; its privacy policy says source code, binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app.cacomi-app.com · read 7 Oct 2026
- Local safety
- The feature page says analysis runs locally, archive extraction is hardened against path traversal and zip bombs, and destructive actions show a preview before confirmation.cacomi-app.com · read 7 Oct 2026
- Mobile and backend coverage
- Cacomi analyzes native iOS and Android projects, Flutter projects and Python backends.cacomi-app.com · read 7 Oct 2026
- Privacy
- The privacy policy says source code, app binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app.cacomi-app.com · read 7 Oct 2026
- Privacy and purchases
- The privacy policy says Apple handles payment and subscription processing for purchases through the Mac App Store, and may provide limited transaction information to validate paid access.cacomi-app.com · read 7 Oct 2026
- Product
- Cacomi scans source code and app binaries for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues.cacomi-app.com · read 7 Oct 2026
- Reports
- Cacomi exports PDF reports with severity, confidence, evidence and remediation per finding, with secrets masked.cacomi-app.com · read 7 Oct 2026
- Reports and CI
- Cacomi exports PDF reports and findings in SARIF and JSON for pipelines including GitHub Actions, GitLab CI, Bitrise and Azure DevOps.cacomi-app.com · read 7 Oct 2026
- Secret handling
- Secret detection covers source, configuration and binary strings, and the maker says detected values remain masked.cacomi-app.com · read 7 Oct 2026
- Security limits
- Cacomi is a pre-release static analysis tool; the maker says it does not replace dynamic testing, penetration testing, manual review or official certification.cacomi-app.com · read 7 Oct 2026
