For the complete documentation index, see llms.txt. This page is also available as Markdown.
Trivy
Trivy consumes the Seal vulnerability feed natively. No customer-side configuration is required.
Aqua Security's Trivy is a widely used open-source vulnerability scanner that runs against filesystems, container images, and SBOMs. Trivy natively consumes the Seal vulnerability feed; sealed packages are recognized as remediated out of the box.
Coverage
Trivy recognizes every sealed package across every Seal-supported ecosystem, whether the package is installed under its original name or under the seal--prefixed name produced by Package renaming. No special configuration on Trivy's side is needed for either case.
Customer-side setup
None. Run Trivy as you normally would; sealed packages are scored from the feed.
Relationship to VEX records
For SBOMs you produce yourself, attaching VEX records per artifact remains a clean way to ship remediation evidence inline with the SBOM. Trivy honors VEX statements bundled with an SBOM where applicable; this complements but does not replace the feed-side recognition.
