> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/external-scanners/vex-records.md).

# VEX records

A Vulnerability Exploitability eXchange (VEX) record is a machine-readable statement that, for a specific software artifact, declares the status of one or more vulnerabilities against that artifact. Seal publishes a VEX record for every sealed package version, listing which vulnerabilities are fixed in that version and which remain affected.

VEX is the artifact format scanners attach to an SBOM to communicate "this vulnerability is no longer applicable" without having to update the scanner's own database. A scanner that reads SBOMs and their associated VEX records will see a sealed package version's vulnerability status authoritatively, even if the scanner has never heard of Seal.

## What a Seal VEX record contains

Per sealed package version, the VEX record states:

* The artifact it applies to (ecosystem, package name, sealed version).
* Each vulnerability the sealed version closes, listed as fixed.
* Each vulnerability that remains open against the sealed version, listed as affected, with the vulnerability identifier.

The records follow standard VEX schemas and can be embedded inside a CycloneDX SBOM where the SBOM tooling supports it.

## Downloading a VEX record

Per-package and bulk downloads both live on the Protection page.

### Per package

On the Sealed packages tab, open a row's action menu and click **Download VEX attestation**. The file is generated on demand and delivered through a toast notification when ready.

<figure><img src="/files/6xdjGsGkIjTVS098r8tm" alt="Sealed packages tab row action menu showing the Download VEX attestation item"><figcaption><p>Per-package VEX record download lives in the row's action menu on the Sealed packages tab.</p></figcaption></figure>

### Bulk

From the Sealed packages tab's top-level actions, **Download all VEX attestations** generates a bundle covering every row currently visible under the tab's filters. Use the tab's filters first to narrow to the scope you want before triggering the bulk download.

## When to use a VEX record

* You produce an SBOM for an artifact that includes sealed packages, and you want consumers to score it correctly.
* A scanner you do not control is consuming an SBOM you produced and is flagging sealed packages as vulnerable.
* An auditor wants per-artifact remediation evidence rather than a feed-wide statement.

For all of these, the VEX record is the artifact to ship alongside the SBOM.

## Related

* [The Seal vulnerability feed](/integrations/external-scanners/vulnerability-feed.md)
* [Attestations](/trust/attestations.md): the broader chapter that VEX records sit inside; covers PDF attestations alongside VEX.
* [Trivy](/integrations/external-scanners/trivy.md), [Wiz](/integrations/external-scanners/wiz.md)