security scanner

f*** your
app.

POINT IT AT YOUR APP. IT TRIES TO BREAK IT.
THAT IS THE WHOLE THING.

read the docs →$ pip install fya

non-destructive. receipts, not he-said.

caught on camera
docket 001 / subject: a local flask app / plea: guilty, proven
EXHIBIT Aa real scan of a real app. nothing staged.
fya web scan output: SQL injection, reflected XSS, SSRF to cloud metadata, exposed .git, CORS bypass, each mapped to a CWE and an OWASP category

real output from a real scan. every line above is fya talking, not the website.

91
checks, each with a test that keeps it silent on a hardened app
3
target kinds from one command
6
report formats, sarif included
0
accounts, agents, or dashboards

Wanted in three forms.

one command, auto-detected
#web
$ fya scan http://localhost:3000

Fuzzes inputs, walks the routes, probes access control. Injections proven by an arithmetic oracle.

#apk
$ fya scan app-release.apk

Unpacks the manifest and the DEX. Exported providers, deep-link hijacking, v1 signing, debug certs.

#source
$ fya scan ./services

Reads the code and the infrastructure. Hardcoded secrets, SQL by concatenation, weak IaC.

The catalog. 91 felonies.

every check maps to OWASP and a CWE
web45 checks
  • injection

    Command injection, XXE, boolean-blind SQLi, SSTI, LFI wrappers, NoSQL operators.

  • exposure

    Actuators and heap dumps, phpinfo, the Werkzeug console, backup copies of live source.

  • secrets

    Keys in client JavaScript, source maps, dumpable .git, leaked config.

mobile and source29 checks
  • apk

    Network security config, exported providers, deep-link hijacking, v1 signing, debug certs.

  • whitebox

    Hardcoded secrets, committed key material, SQL by concatenation, verify disabled.

  • iac

    Dockerfile and Compose hardening, Kubernetes workloads, Terraform exposure, Actions.

api and transport17 checks
  • api

    OpenAPI and Swagger exposure, GraphQL introspection, OIDC discovery, SOAP and WSDL.

  • tls

    Certificate trust and expiry, weak protocols, key size, mixed content.

  • tools

    Nuclei, Nikto, nmap, sqlmap, and testssl folded into one report when installed.

crit / highmediumlowpassnote
the full catalog, check by check →open a real html report →
apk, also wanted

An APK is a target too.

Manifest and DEX, no androguard required. Export surface, deep links, signing scheme, debug certs. Found on the spot, proven in the report.

EXHIBIT Bapk scan, captured from a real run.
fya APK scan output: manifest and DEX findings mapped to OWASP MASVS

The sequence.

six stages, self-throttled
01detect

a server, an APK, or a source tree

02fingerprint

the stack, from the first responses

03plan

only the checks that fit the target

04break

non-destructive probes, paced to what it tolerates

05prove

dedup, OWASP and CWE, receipts kept

06report

console, JSON, SARIF, Markdown, or HTML

no terminal? fine

Tell Claude to break it.

fya ships as a Claude skill. Drop it in, say what to scan, and Claude confirms you own the target, runs the same non-destructive checks, and reports back in the chat with no package to install.

install
shell
git clone https://github.com/ayam04/fya
cp -r fya/skills/fya ~/.claude/skills/fya
ask
claude
scan http://localhost:3000 for vulnerabilities
check ./app-release.apk for security issues
full skill setup in the docs →
it is non-destructive, we checked

Break your app before
someone else does.

start with your localhost right now. one command, a couple of seconds, receipts included. no accounts, no agents. just you, your terminal, and a stack of receipts.

read the docs →$ pip install fya
CAUTION
Non-destructive by default. Localhost is fair game. Any remote target needs an explicit --i-am-authorized flag. Test only what you own.