For the complete documentation index, see llms.txt. This page is also available as Markdown.
VEX records
Per-sealed-package machine-readable Vulnerability Exploitability eXchange records attached to SBOMs.
A Vulnerability Exploitability eXchange (VEX) record is a machine-readable statement that, for a specific software artifact, declares the status of one or more vulnerabilities against that artifact. Seal publishes a VEX record for every sealed package version, listing which vulnerabilities are fixed in that version and which remain affected.
VEX is the artifact format scanners attach to an SBOM to communicate "this vulnerability is no longer applicable" without having to update the scanner's own database. A scanner that reads SBOMs and their associated VEX records will see a sealed package version's vulnerability status authoritatively, even if the scanner has never heard of Seal.
What a Seal VEX record contains
Per sealed package version, the VEX record states:
The artifact it applies to (ecosystem, package name, sealed version).
Each vulnerability the sealed version closes, listed as fixed.
Each vulnerability that remains open against the sealed version, listed as affected, with the vulnerability identifier.
The records follow standard VEX schemas and can be embedded inside a CycloneDX SBOM where the SBOM tooling supports it.
Downloading a VEX record
Per-package and bulk downloads both live on the Protection page.
Per package
On the Sealed packages tab, open a row's action menu and click Download VEX attestation. The file is generated on demand and delivered through a toast notification when ready.
Per-package VEX record download lives in the row's action menu on the Sealed packages tab.
Bulk
From the Sealed packages tab's top-level actions, Download all VEX attestations generates a bundle covering every row currently visible under the tab's filters. Use the tab's filters first to narrow to the scope you want before triggering the bulk download.
When to use a VEX record
You produce an SBOM for an artifact that includes sealed packages, and you want consumers to score it correctly.
A scanner you do not control is consuming an SBOM you produced and is flagging sealed packages as vulnerable.
An auditor wants per-artifact remediation evidence rather than a feed-wide statement.
For all of these, the VEX record is the artifact to ship alongside the SBOM.
