Quokka Q-mast

Q-mast is a mobile application security testing (MAST) product from Quokka that analyzes iOS and Android apps without requiring source code. It examines compiled app binaries, including obfuscated or signed builds, using static analysis (SAST), dynamic analysis (DAST), interactive analysis (IAST), and forced-path execution to identify security, privacy, and compliance risks. The product generates version-precise software bills of materials (SBOMs), analyzes SDK behavior beyond CVE lookups, and identifies vulnerable or risky third-party components and dependencies within the mobile software supply chain. Q-mast checks findings against industry standards including NIAP, NIST, OWASP MASVS, CVEs, SARIF, and GDPR, and maps results to relevant compliance controls. It also detects whether apps or embedded SDKs transmit user or corporate data offshore or communicate with unknown external servers. The tool integrates with CI/CD and DevSecOps pipelines through GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, allowing security testing to be incorporated into development workflows without requiring source code access. It also offers post-deployment monitoring of production apps directly from app stores via an "App Watch List" feature, without requiring device agents.