Integrate NowSecure with Vulnetix. Use the NowSecure REST API to retrieve automated mobile security assessment findings and upload to Vulnetix for mobile vulnerability tracking.
Run NowSecure in CI
Scan on every push and upload the report as a workflow artifact:
- name: Submit app to NowSecure
env:
NS_TOKEN: ${{ secrets.NS_TOKEN }}
run: |
TASK_ID=$(curl -s -X POST "https://api.nowsecure.com/build" -H "Authorization: Bearer $NS_TOKEN" -F "binary=@app-release.apk" | jq -r '.task')
echo "TASK_ID=$TASK_ID" >> $GITHUB_ENV
- name: Retrieve findings
run: |
sleep 300 # Allow time for assessment
curl -s "https://api.nowsecure.com/assessment/$TASK_ID/results" -H "Authorization: Bearer $NS_TOKEN" | jq '.findings' > nowsecure-findings.json
- name: Upload to Vulnetix
run: vulnetix upload --file nowsecure-findings.json
How Vulnetix compares: better together
Vulnetix does not replace NowSecure. Keep running it. Vulnetix sits on top of NowSecure (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
NowSecure is strongest at its core category and also carries features in SAST, DAST, SCA, SBOM Generation, Secret Scanning, Network & Vulnerability Scanners, Pentest, Bug Bounty & Vulnerability Disclosure, just as Vulnetix spans categories.
| Capability | Vulnetix | NowSecure |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ~ Static analysis of mobile binaries/code for insecure patterns, secrets and misconfig |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ~ Detects third-party mobile libraries and supply-chain risk within apps |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ~ Dynamic runtime analysis of app behaviour, encryption and data handling on-device |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ~ Static analysis surfaces hardcoded secrets in mobile binaries |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✓ Core: automated static+dynamic+interactive security/privacy testing of iOS/Android apps on real devices |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Generates a dynamic CycloneDX binary SBOM with each assessment |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ~ Inspects app network traffic and API calls during dynamic analysis |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ~ Offers expert manual mobile penetration testing (MASVS L1/L2) alongside the automated platform |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What NowSecure does well
- Purpose-built mobile (MAST) depth: runs 600+ tests combining SAST, DAST, IAST and API security testing against real/emulated iOS and Android devices
- Runtime behavioural analysis (network traffic inspection, data-storage examination, crypto and privacy checks) that only device-based dynamic testing can reveal
- Standards and compliance alignment (OWASP MASVS/MASTG, app-store blockers, privacy) with expert manual mobile pentesting to augment automation
- Broad platform reach (iOS, Android) plus a dynamic CycloneDX binary SBOM generated per assessment and rich DevSecOps integrations (GitHub Action, ns-cli, Jenkins, GitLab)
Where Vulnetix adds to it: Vulnetix has no native mobile testing engine and does NOT run MAST/dynamic device tests. NowSecure is irreplaceable for that. Vulnetix ingests and orchestrates NowSecure's findings (via its REST API / GitHub Action / SARIF export and per-assessment SBOM), dedups them with the rest of your web/cloud/dependency scanners into one queue, and layers exploit-intel prioritisation, versioned VEX+audit, EOL and SSVC policy on top. Better together: NowSecure runs the mobile tests, Vulnetix consolidates and prioritises the output.
No migration, no rip-and-replace. NowSecure keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise NowSecure results in Vulnetix
Upload NowSecure JSON, SARIF, PDF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.