SEBASTiAn
What it is
SEBASTiAn is a free, open-source static analysis tool for assessing mobile application security. It examines Android APK and iOS IPA files on Linux, macOS, and Windows, with self-hosted deployment from source or through an official Docker image. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The modular, extensible project can create a unified JSON report containing vulnerabilities, remediation suggestions, further-reading links, and vulnerable code or configuration locations. The --generate-report option saves findings as JSON, and reports can use English or Italian. Analysis defaults to 1,200 seconds, with a configurable timeout. Installation guidance requires Python 3 and CMake. Python 3.12 or later may require manual LIEF installation. Static binary analysis is supported; dynamic app analysis is not.
For and against
For
- Free AGPL-3.0 open-source plan
- Analyzes Android APK and iOS IPA files
- Runs on Linux, macOS, and Windows
- Produces JSON vulnerability reports
- English and Italian report languages
Against
- No dynamic app analysis
- Requires Python 3 and CMake
- Python 3.12+ may need manual LIEF installation
- Commercial use requires a separate license
The verdict
SEBASTiAn provides cross-platform static checks for both major mobile app formats. Its report generation and configurable runtime suit self-hosted security assessment, while the lack of dynamic analysis limits its scope.
Who it suits
SEBASTiAn suits security teams and developers assessing Android or iOS binaries on their own infrastructure. It fits users who need structured findings and remediation information in JSON.
Plans and prices
AGPL-3.0 open-source license
For open-source projects
Read 7 Oct 2026 · github.com
Commercial license
Required for commercial use or closed-source projects; contact [email protected]
Read 7 Oct 2026 · github.com
On the record
- Analysis checks
- Its Android checks cover issues including insecure networking, cryptography, permissions, exported components, and WebView configuration.github.com · read 7 Oct 2026
- Analysis limit
- The default analysis timeout is 1,200 seconds, and users can set a different timeout.github.com · read 7 Oct 2026
- Compatibility note
- The README says Python 3.12 or later may require manually installing LIEF because stable prebuilt wheels are unavailable.github.com · read 7 Oct 2026
- Extensibility
- The project describes SEBASTiAn as extensible and modular.github.com · read 7 Oct 2026
- iOS checks
- Its iOS checks include binary encryption and signature, insecure APIs and TLS settings, weak cryptography, and memory-protection flags.github.com · read 7 Oct 2026
- Language support
- The command line offers English and Italian as vulnerability-report languages.github.com · read 7 Oct 2026
- Maker
- Talos Security identifies itself as a Genoa-based innovative SME founded in 2016 as a spin-off of the University of Genoa.talos-sec.com · read 7 Oct 2026
- Mobile targets
- It analyzes Android APK and iOS IPA applications.github.com · read 7 Oct 2026
- Output option
- The command-line option --generate-report saves identified vulnerabilities as a JSON file.github.com · read 7 Oct 2026
- Platform requirements
- The README lists Ubuntu, Windows, and macOS installation guidance and requires Python 3 and CMake.github.com · read 7 Oct 2026
- Project support
- The maintainers welcome questions, bug reports, and pull requests on GitHub.github.com · read 7 Oct 2026
- Publication
- The project README links to a 2023 SoftwareX paper about SEBASTiAn.github.com · read 7 Oct 2026
- Purpose
- SEBASTiAn is a static, extensible, platform-agnostic tool for assessing mobile application security.github.com · read 7 Oct 2026
- Reports
- It can produce a unified JSON report with vulnerabilities, remediation suggestions, further-reading links, and the location of vulnerable code or configuration.github.com · read 7 Oct 2026
- Run options
- The tool can be run from source or from its Docker image, and the repository links to an official Docker Hub image.github.com · read 7 Oct 2026
