Cacomi

What Cacomi is

Cacomi is a macOS static analysis tool for developers reviewing source code and app builds. It checks for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues across native iOS and Android projects, Flutter projects, and Python backends. It can scan IPA, APP, and APK files, and checks mobile apps for issues such as weak cryptography, insecure storage, and WebView misuse. Cacomi also identifies AI service calls, potential data exposure to AI providers, prompt handling, and embedded AI or ML models, collecting those findings in an AI BOM inventory. Unused-code findings use language-specific parsing, reference counting at three levels, and confidence scores. Secret checks cover source, configuration, and binary strings, with detected values masked, according to the maker. Analysis runs on-device, and the privacy policy says the app does not intentionally upload code, binaries, results, or reports. Reports can be exported as PDF, SARIF, or JSON. Mobile findings map to OWASP MASVS and MASTG; Python findings map to OWASP ASVS. Cacomi is a pre-release tool and does not replace deeper security testing or certification.