I built a very similar home NAS with the newer RockPro64 and a pair of 4TB HDDs in RIAD1, all on top of Debian[0]. I found OpenMediaVault to be overkill and kept me from really understanding what was going on. Plus there are a million guides to setting up SMB, rsync, Borg, etc.
The RockPro64 hardware is great. Very performant, especially when using the PCIe to SATA card instead of USB like the OP did.
Skipfish and wapiti are quite a bit different than this. They are simply blackbox scanners that attempt to crawl a webpage and look for common issues, mostly by trial and error. This is examining the source code of an application, finding all the sinks, building a graph, and working backwards through the graph to find sources that can pass input to the vulnerable sinks.