Discovering vulnerabilities

How Seal discovers your packages, and the UI surfaces you use to triage what it finds.

Seal needs to see your packages before it can remediate them. This section covers the four ways Seal sees your environment (the package discovery modes), the connections that feed them, and the UI pages where you triage the discovered vulnerabilities day-to-day.

What's in this section

• How Seal discovers your packages: the model and the four discovery modes.

• Package discovery mode: one page per mode (source code, CLI, artifact server, imported manifest).

• Connecting source control: GitHub, GitLab, Azure DevOps; connection management.

• Connecting via the Seal CLI in CI: the CLI as the discovery signal.

• Configuring the Seal Artifact Server for discovery: when your build pulls drive discovery.

• Importing manifests & SBOMs: one-shot import from a dependency manifest or SBOM.

• The Dashboard: the tenant-wide aggregate view.

• The Protection page: the per-package triage view, with four tabs (vulnerable, sealed, sealing rules, scanner exclusions).

• Package states: the six states a vulnerable package can be in.

• Triggering Generate fix: asking Seal to build a sealed version on demand.

• The package drawer: the per-package drawer.

• The Repository page: the public catalog of sealed packages.

• Partial fixes & open vulnerabilities: when a sealed version still carries open vulnerabilities, and why.

• Private versions: sealed versions whose fix introduces a breaking change.