Quick Start

Get up and running with Alprina in 5 minutes. This guide will walk you through installation, your first scan, and generating reports.

Step 1: Install Alprina

Install Alprina using pip:


pip install alprina-cli

Verify the installation:


alprina --version

Expected output:


Alprina CLI version 1.0.0

→ Full installation guide

Step 2: Authentication (Optional)

Authentication is optional for local scans but required for remote targets.

Skip Authentication (Local Scans Only)

If you’re only scanning local files, you can skip authentication:


# No auth needed - just scan!
alprina scan ./my-project

Authenticate for Remote Scans

For scanning remote APIs, URLs, or IPs, authenticate first:


alprina auth login

You’ll be prompted for your API key. Get one at alprina.com/dashboard .

Quick login with API key:


alprina auth login --api-key YOUR_API_KEY

Check authentication status:


alprina auth status

Step 3: Run Your First Scan

Scan a Local Directory

The most common use case - scan your project:


alprina scan ./src

Example output:


🛡️  Alprina Security Scan
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 Starting scan on: ./src
Profile: default
Mode: Safe only

→ Detected local target: ./src
→ Scanning local files...

✓ Scan complete!

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Results Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Found 3 findings:

  🔴 HIGH: Hardcoded API key detected
     File: src/config.py:12
     API_KEY = "sk_live_1234567890abcdef"

  🟡 MEDIUM: SQL injection vulnerability
     File: src/database.py:45
     query = f"SELECT * FROM users WHERE id = {user_id}"

  🟢 LOW: Outdated dependency
     Package: requests 2.25.0 (latest: 2.31.0)
     Potential security vulnerabilities in old version

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

💡 Run 'alprina mitigate' for fix suggestions
📊 Run 'alprina report' to generate detailed report

Scan a Single File


alprina scan app.py

Scan with a Specific Profile


# Deep code analysis
alprina scan ./src --profile code-audit
 
# Web application scanning
alprina scan https://api.example.com --profile web-recon
 
# API security testing
alprina scan https://api.example.com --profile api-security

Available Profiles:

default - Standard security scan
code-audit - Deep static code analysis
web-recon - Web application reconnaissance
api-security - API endpoint security testing

Scan Remote Targets (Requires Auth)


# Scan a URL
alprina scan https://example.com --profile web-recon
 
# Scan an IP address
alprina scan 192.168.1.1 --safe-only
 
# Scan an API endpoint
alprina scan https://api.example.com/v1 --profile api-security

Step 4: View Detailed Results

Generate an HTML Report

Create an interactive HTML report with full details:


alprina report --format html

The report will open automatically in your browser and includes:

Executive summary with metrics
Detailed findings with code context
Severity breakdown
Remediation recommendations
Timeline and scan metadata

Save report to specific location:


alprina report --format html --output ~/security-report.html

Generate a PDF Report

Create a professional PDF document:


alprina report --format pdf --output security-report.pdf

Perfect for:

Sharing with stakeholders
Compliance documentation
Security audits

Generate JSON for CI/CD

Get machine-readable JSON output:


alprina report --format json --output results.json

Use in CI/CD pipelines to:

Parse findings programmatically
Fail builds on HIGH severity
Track metrics over time
Integrate with other tools

Step 5: Get AI-Powered Fix Suggestions

Get intelligent remediation suggestions from AI:


alprina mitigate

Example output:


🛠️  AI-Powered Mitigation Suggestions
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Finding: Hardcoded API key detected
File: src/config.py:12

🤖 Recommendation:

1. Move API key to environment variable:

   # In src/config.py
   import os
   API_KEY = os.environ.get('API_KEY')

2. Add to .env file (don't commit!):

   # .env
   API_KEY=sk_live_1234567890abcdef

3. Update .gitignore:

   # Add to .gitignore
   .env
   .env.local

4. Use python-dotenv to load:

   pip install python-dotenv

   # At top of config.py
   from dotenv import load_dotenv
   load_dotenv()

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Finding: SQL injection vulnerability
File: src/database.py:45

🤖 Recommendation:

Use parameterized queries instead of string formatting:

# ❌ VULNERABLE
query = f"SELECT * FROM users WHERE id = {user_id}"

# ✅ SECURE
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))

# Or with named parameters
query = "SELECT * FROM users WHERE id = :user_id"
cursor.execute(query, {"user_id": user_id})

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Get suggestion for specific finding:


alprina mitigate VULN-2024-001

Process findings from a report:


alprina mitigate --report results.json

Step 6: Configure Alprina (Optional)

Initialize Configuration

Create a default configuration file:


alprina config --init

This creates ~/.alprina/config.yaml with default settings.

Initialize Security Policy

Create a policy file to control what can be scanned:


alprina policy init

This creates alprina-policy.yaml in your project:


version: "1.0"
 
allowed_targets:
  - localhost
  - 127.0.0.1
  - "*.internal.company.com"
 
blocked_targets:
  - "*.gov"
  - "*.mil"
  - "production.company.com"
 
scan_options:
  safe_only: true
  max_depth: 3
  timeout: 300

Test a target against your policy:


alprina policy test api.example.com

→ Full policy guide

Common Workflows

Daily Development Workflow


# 1. Scan before committing
alprina scan ./src
 
# 2. Fix any HIGH severity issues
alprina mitigate
 
# 3. Commit when clean
git commit -m "feat: add feature X (security validated)"

CI/CD Integration Workflow


# 1. Install in CI
pip install alprina-cli
 
# 2. Scan codebase
alprina scan ./src --output results.json
 
# 3. Generate report
alprina report --format json --output report.json
 
# 4. Fail build on HIGH severity
alprina scan ./src || exit $?

→ GitHub Actions guide

Security Audit Workflow


# 1. Run deep analysis
alprina scan ./src --profile code-audit
 
# 2. Generate comprehensive report
alprina report --format pdf --output audit-report.pdf
 
# 3. Get remediation steps
alprina mitigate --report results.json
 
# 4. Track progress
alprina scan ./src --output after-fixes.json

What’s Next?

Learn More

Your First Scan Tutorial - Detailed walkthrough with real examples
Configuration Guide - Customize Alprina settings
CLI Command Reference - Complete command documentation

Integrations

GitHub Actions - Automate security in CI/CD
Security Policies - Create custom scanning rules
Docker Integration - Run in containers

Advanced Topics

Scan Profiles - Deep dive into scanning modes
Report Formats - HTML, PDF, JSON options
Exit Codes - CI/CD integration patterns

Quick Reference Card


# Installation
pip install alprina-cli
 
# Authentication (optional for local)
alprina auth login --api-key YOUR_KEY
 
# Scanning
alprina scan ./src                    # Local directory
alprina scan app.py                   # Single file
alprina scan ./src --profile code-audit  # With profile
alprina scan https://api.example.com  # Remote target
 
# Reports
alprina report --format html          # HTML report
alprina report --format pdf           # PDF report
alprina report --format json          # JSON output
 
# Mitigation
alprina mitigate                      # All findings
alprina mitigate VULN-ID              # Specific finding
 
# Configuration
alprina config --init                 # Init config
alprina policy init                   # Init policy
 
# Utilities
alprina auth status                   # Check auth
alprina --version                     # Version info
alprina --help                        # Show help

Need Help?

🛡️ Build fast. Guard faster.