Sharang ParnerkarandClaude Opus 4.8
5ad9d2d77c
CI / Check (push) Skipped
CI / Detect Changes (pull_request) Skipped
CI / Deploy Agent (pull_request) Skipped
CI / Deploy Dashboard (pull_request) Skipped
CI / Deploy Docs (pull_request) Skipped
CI / Deploy MCP (pull_request) Skipped
CI / Check (pull_request) Failing after 1m55s
The product is renamed Certifai -> Prüfwerk. This changes only the user-facing brand text in the documentation (docs/**, VitePress title/name). It does NOT touch functional identifiers that happen to contain "certifai" (the Docker network, Keycloak realm/client, Harbor image project, the compliance-* crate names, or the repo name) — those are infra-coupled and need a separate, coordinated migration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
50 lines
2.7 KiB
Markdown
50 lines
2.7 KiB
Markdown
# Getting Started
|
|
|
|
Prüfwerk is an AI-powered security compliance platform that scans your Git repositories for vulnerabilities, builds software bills of materials, performs dynamic application testing, and provides code intelligence through an interactive knowledge graph and AI chat.
|
|
|
|
## What You Get
|
|
|
|
When you connect a repository, Prüfwerk runs a comprehensive scan pipeline that covers:
|
|
|
|
- **Static Analysis (SAST)** -- finds code-level vulnerabilities like injection flaws, insecure crypto, and misconfigurations
|
|
- **Software Bill of Materials (SBOM)** -- inventories every dependency, its version, and its license
|
|
- **CVE Monitoring** -- cross-references your dependencies against known vulnerabilities
|
|
- **Code Knowledge Graph** -- maps the structure of your codebase for impact analysis
|
|
- **AI Triage** -- every finding is reviewed by an LLM that provides severity assessment, confidence scores, and remediation guidance
|
|
- **Issue Tracking** -- automatically creates issues in your tracker for new findings
|
|
|
|
## Dashboard Overview
|
|
|
|
After logging in, you land on the Overview page, which gives you a snapshot of your security posture across all repositories.
|
|
|
|
|
|
|
|
The overview shows key metrics at a glance: total repositories, findings broken down by severity, dependency counts, CVE alerts, and tracker issues. A severity distribution chart visualizes your risk profile, and recent scan runs let you monitor scanning activity.
|
|
|
|
## Quick Walkthrough
|
|
|
|
Here is the fastest path from zero to your first scan results:
|
|
|
|
### 1. Add a repository
|
|
|
|
Navigate to **Repositories** in the sidebar and click **Add Repository**. Enter a name, the Git clone URL, and the default branch to scan.
|
|
|
|
|
|
|
|
### 2. Trigger a scan
|
|
|
|
Click the **Scan** button on your repository row. The scan runs in the background through all phases: cloning, static analysis, SBOM extraction, CVE checking, graph building, and issue sync.
|
|
|
|
### 3. View findings
|
|
|
|
Once the scan completes, navigate to **Findings** to see everything that was discovered. Each finding includes a severity level, description, code evidence, and AI-generated remediation guidance.
|
|
|
|
|
|
|
|
## Next Steps
|
|
|
|
- [Add and configure repositories](/guide/repositories) -- including private repos and issue tracker setup
|
|
- [Understand how scans work](/guide/scanning) -- phases, triggers, and deduplication
|
|
- [Work with findings](/guide/findings) -- triage, false positives, and developer feedback
|
|
- [Explore your SBOM](/guide/sbom) -- dependencies, licenses, and exports
|