FYA(1)FYA(1)

Changelog

Every release of fya. New checks land with the tests that prove they fire on a broken app and stay quiet on a hardened one, so the entries below list the false-positive fixes as prominently as the features.

check catalog →releases on githubpypi

v0.6.0

latest

33 new checks, a false-positive gate over every one of them, and per-check selection.

Added
  • 33 new checks, taking the catalog from 58 to 91. Every one ships with a positive test and a negative test that proves it stays silent on a hardened app.
  • Advanced injection: OS command injection confirmed by an arithmetic oracle rather than reflection, XXE via two-stage entity expansion, boolean-blind SQLi confirmed across two SQL syntaxes, PHP stream wrappers, and JSON NoSQL operator injection.
  • Exposure: Spring Boot actuator endpoints including heap dumps, phpinfo and server-status and Werkzeug console pages, backup and editor copies of live source files, OIDC discovery misconfiguration, and exposed SOAP and WSDL endpoints.
  • Crypto and tokens: JWT signed with a guessable secret (tested offline, costing the target no requests), jku, x5u and kid header injection, certificate key size and signature algorithm and validity window, mixed content, and serialized Java, PHP and ASP.NET ViewState blobs.
  • Infrastructure as code and supply chain: Dockerfile and Compose hardening, Kubernetes workload security, Terraform exposure, insecure package sources, and pwn-request and script injection in GitHub Actions workflows.
  • Source analysis: committed key material, weak crypto usage, SQL built by string concatenation, and disabled certificate verification.
  • Android: network security config, exported content providers, backup rules, deep-link hijacking surface, v1-only signing and debug certificates, weak crypto constants, insecure TLS code, and build hardening.
  • fya checks lists the full catalog, with --only to filter by category and --json for machine output.
  • --only and --skip now accept an individual check id as well as a category, so --only web.ssrf and --skip web.backup_files both work.
  • A binary AndroidManifest.xml decoder, so the new manifest checks run without androguard installed.
Changed
  • run_scan() accepts an exclude set, and its categories argument now matches either a category or a single check id.
  • CI gates on mypy in addition to ruff and the test suite.
Fixed
  • web.json_nosql_operators treated any sub-500 status change as evidence of injection, so an API that correctly rejected the operator object (a FastAPI or Pydantic 422, a DRF 400) was reported as vulnerable. It now requires the response to move toward success, and reports a body-only differential at low confidence.
  • web.json_nosql_operators picked its probe field from an unordered set, so whether the check fired at all varied with the interpreter hash seed.
  • The false-positive control test covered only 8 checks; it now covers 23, including every new dynamic check.
  • New checks' tests ran the whole battery per test, which made results depend on concurrent load and the suite intermittently red. Each test now scopes its scan to the checks it exercises.
  • base_url() and Target.host could be None and were passed on unguarded in the passive, SSRF and crawling checks.
  • The scanner is now clean under mypy across all 45 modules.

v0.5.1

Commercial-license notice in the CLI.

Added
  • A commercial-license notice in the CLI banner, and COMMERCIAL-LICENSE.md.

v0.5.0

16 new attack techniques and an audit pass over the check implementations.

Added
  • 16 new attack techniques across the web, API, header and mobile areas.
Changed
  • Dual-licensed under PolyForm Noncommercial 1.0.0; commercial use requires a paid license.
  • The website adapts to phones, with a hamburger section menu for the docs.
Fixed
  • 15 bugs found in an audit of the check implementations.

v0.4.0

Black, gray and white box as switchable modes, plus the Claude skill.

Added
  • Black box, gray box and white box test strategies as switchable modes.
  • A bundled Claude skill that performs the same methodology in a session with no package installed.
  • A Next.js overview and documentation site.
Changed
  • The package version is single-sourced from fya/__init__.py.

v0.3.0

Authenticated scanning, scope controls, and baseline suppression.

Added
  • Authenticated scanning with --header, --cookie and --bearer.
  • Scope controls to keep scans bounded: --include, --exclude and --max-requests.
  • Baseline suppression: record known findings with --write-baseline, hide them later with --baseline.
  • New checks: JWT weaknesses, Content-Security-Policy analysis, outdated JavaScript libraries, and security.txt and robots.txt discovery.
  • An optional Playwright-based SPA crawler, and entry-point plugin support under the fya.checks group.
Fixed
  • Audit-driven false-positive fixes across reflected XSS, SSTI, CSRF, CORS and verbose-error detection.

v0.2.0

Scan profiles, live progress, and machine-readable reports.

Added
  • Scan profiles (passive, safe, aggressive) with per-check profile gating.
  • Live progress reporting during a scan.
  • JSON and Markdown report writers.
Changed
  • The check registry auto-discovers bundled checks.

v0.1.0

First release.

Added
  • Dynamic security scanner for localhost web servers and Android APKs.
  • Passive web checks: security headers, server version disclosure, and insecure cookie flags.
  • Command-line interface with target parsing for web and APK kinds.