Hey kids, here's some bullets! Don't spend them all in one place.

heavy wip: this is basically a todo list

lofwyr is a modular, pure-python tool intended to perform a lightweight security code review. it is completely free, easy to integrate into any existing continuous integration lifecycle / toolchain, and completely customizable.

note that this is a spare time project, written in desperation due to an unbelievably shit 'startup culture' market for this stuff. if you want a specific feature, let me know and i can look into it, but ::no promises::.

hatemail to lin_s.

lofwyr is designed to be simple enough to use anywhere, against any target. just run:

./lofwyr target

the target can be any one of:

• URL (starting with http: or https:
• file
• path
• host

lofwyr will attempt to resolve in the above order: that is, if you call ./lofwyr abcd and you have a file abcd and a host abcd, it will attempt to scan the file instead of the host

lofwyr isn't as comprehensive as some of the commercial security offerings, but you should use it because:

• i'm not lying to you: other products will sell you some bong smoke pipe dream of "big data", "no false positives", "0day protection" and "cloud analytics". i am not financially incentvized to scam you: lofwyr is basically glorified grep, and does not pretend to be more.
• this isn't openly backdoored: other code review products will do everything from sending your code overseas to running unsigned http-fetched code updates. this code sits on github, you can review every socket call yourself, disable them all and check with wireshark.
• this isn't contrast security: from an ethical perspective, i didn't take over leadership of the owasp top ten project and then insert "A7 - Insufficient Application Protection" into the 2017 release candidate document, and then use an industry best practice standard as advertising. i won't claim to be the most morally upstanding person, but lofwyr isn't rancid with corruption.
• designed with compliance in mind: this tool is designed to fulfill corporate security policy compliance requirements - making it easy to tick that checkbox and never give a shit about security again, if you want.
• ez mode integration: most products require weeks of time and thousands of dollars of consulting investment to even get working. this is like owasp zap - just give it to your developers and it'll work standalone, or web hook this into your CI pipe and watch the magic.