Pavise

Fast static security analysis for iOS IPA files. Sub-second scans with comprehensive coverage.

Quick Start

# Install (macOS and Linux, arm64 and x86_64)
brew install ahmetmutlugun/tap/pavise

# Scan
pavise app.ipa

# HTML report
pavise app.ipa --format html -o report.html

Without Homebrew, the install script downloads the prebuilt binary for your platform and verifies its checksum (installs to /usr/local/bin; set PAVISE_INSTALL_DIR to change it):

curl -fsSL https://raw.githubusercontent.com/ahmetmutlugun/pavise/main/install.sh | sh

Binaries for each release are on the releases page. To build from source (Rust 1.88+): cargo install --locked pavise-cli (the crate is pavise-cli; the command is pavise). PDF output (--format pdf) needs Chrome or Chromium installed.

Or use Docker (linux/amd64 and linux/arm64; the image also serves the web UI by default):

docker run --rm -v "$PWD:/work" ghcr.io/ahmetmutlugun/pavise pavise /work/app.ipa

What It Checks

Category	Examples
Binary protections	NX, PIE, ARC, encryption, RPATH, stack canaries
Manifest analysis	Info.plist, entitlements, provisioning profiles
Secret detection	29 patterns — AWS, GCP, Azure, GitHub, Stripe, Slack, OpenAI, etc.
Dangerous APIs	24 risky iOS APIs (strcpy, NSLog, weak hashes, etc.), attributed to app code vs. dependencies
Tracker detection	19 advertising/analytics SDKs
Trust stores & keys	Bundled root CA stores (PEM, DER, and keys compiled into binaries) that trust compromised or distrusted CAs, e.g. the 2026 eMudhra intermediates; pins on those keys; EC keys with tiny private scalars (details)
Privacy manifests	Missing PrivacyInfo.xcprivacy, undeclared required-reason APIs (ITMS-91053), Apple-listed SDKs without their own manifest (ITMS-91061)
Supply chain	Framework inventory; end-of-life detection for OpenSSL, FFmpeg, Qt, Unity, Python, jQuery and more (endoflife.date data)
Network intel	DNS resolution and IP geolocation (--network)

Output Formats

JSON (default), SARIF 2.1.0, HTML, and PDF. OWASP-based 0–100 scoring with A–F grades.

pavise app.ipa --format sarif -o report.sarif   # IDE / GitHub Code Scanning
pavise app.ipa --format pdf -o report.pdf
pavise app.ipa --baseline previous.json          # Diff against previous scan
pavise app.ipa --min-severity high               # Filter by severity
pavise app.ipa --explain QS-BIN-001              # Explain a finding
pavise app.ipa --quiet                           # Score line only

CI/CD

- uses: ahmetmutlugun/pavise/.github/actions/[email protected]
  with:
    ipa-path: build/App.ipa
    format: sarif          # sarif | json | html | pdf
    fail-on: high          # high | warning | info | none

The step writes a grade and severity table to the job summary and exposes score, grade, findings-count and report-path outputs. Upload the SARIF with github/codeql-action/upload-sarif to see findings in GitHub Code Scanning. Runs on Linux and macOS runners (x86_64 and arm64).

CLI exit codes: 0 clean, 1 high-severity findings, 2 scan error.

Custom Rules

The default rules in rules/ (secrets.yaml, ios_apis.yaml, trackers.yaml, permissions.yaml) are compiled into the binary. --rules DIR replaces the whole set, so copy all four files and edit them; a missing or unparseable file is a scan error (exit 2). Secret rules look like:

- id: QS-SEC-002
  title: "AWS Access Key ID"
  pattern: "AKIA[0-9A-Z]{16}"
  severity: high          # high | warning | info
  category: secrets

License

MPL-2.0