wtf is fya?

fya is a security scanning tool built in Python that you point at something you want to test, and it automatically tries to find weaknesses in it. It can scan a running web server on your own machine, an Android app file, or a folder of source code, and it works out on its own what kind of target it is looking at before running the right checks. The tool includes its own fast checks written in plain Python, and when other well known security tools like Nuclei, Nikto, sqlmap, nmap, testssl, jadx, or apkleaks are already installed on your system, it will call on them instead of duplicating what they already do well. In total it runs 58 different checks, each one linked back to a standard industry list of common security weaknesses called the OWASP Top 10, plus a mobile focused version of that list for Android apps. You choose how the scan behaves by picking a mode, such as web, api, mobile, or a full combined scan, and a profile that ranges from passive and read only, up to a more aggressive active probing style. The scanner adjusts its behavior based on what it detects about the target, and it slows itself down automatically if it notices errors or timeouts, so it does not overwhelm the system being tested. Results can be exported as console output, JSON, a security industry standard format called SARIF, Markdown, or a self contained HTML report, and the tool can be told to fail a build pipeline if it finds anything above a chosen severity level. Scanning anything other than your own local machine requires you to pass a flag confirming you have written authorization to test that target, and the README states plainly that scanning systems without permission may be illegal and is entirely the user's responsibility. The project includes a small deliberately vulnerable sample app so you can try the scanner safely before pointing it at anything real. It can be installed through pip or run inside Docker, and it needs Python 3.9 or newer. The project is released under the PolyForm Noncommercial license, which restricts commercial use.