> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/external-scanners/vulnerability-feed.md).

# The Seal vulnerability feed

The Seal vulnerability feed is the dataset scanners consume when they want to recognize sealed packages as remediated. Conceptually, the feed is a mirror of Seal's view of the world: for every sealed package version Seal has built, the feed enumerates the vulnerabilities that version resolves and the vulnerabilities still open against it.

## What the feed contains

Per sealed package version, the feed records:

* The package identifier (ecosystem, name, version).
* The list of vulnerabilities the sealed version closes, by identifier.
* The list of vulnerabilities still open against the sealed version, by identifier (the "partial fix" case — see [Partial fixes](/discovering/partial-fixes.md)).

## How scanners consume it

The feed is published as machine-readable data at a public Seal endpoint. Scanners that integrate with the feed pull it on their own cadence and incorporate the entries into their vulnerability database alongside the origin sources (NVD, GitHub advisories, OSV, vendor advisories). On the next scan, a sealed package version's known vulnerabilities are scored from the feed entry rather than from the origin version's record.

Today, Trivy and Wiz are the two scanners that natively consume the feed. Neither requires customer-side configuration. See [Trivy](/integrations/external-scanners/trivy.md) and [Wiz](/integrations/external-scanners/wiz.md) for current ecosystem coverage.

## Relationship to VEX records

The feed is a continuously updated dataset listing every sealed package version. [VEX records](/integrations/external-scanners/vex-records.md) are per-package machine-readable statements suitable for attaching to a specific SBOM. A scanner can consume either or both: the feed for completeness across everything Seal has sealed, and a VEX record as the authoritative per-artifact statement that ships with an SBOM.

## How entries change over time

New sealed iterations add entries to the feed. Existing entries can also change as Seal's view of a sealed version evolves: when a new vulnerability is disclosed that affects a sealed version already in the feed, that vulnerability is added to the version's "still open" list and the entry is updated. The feed is the running source of truth, not an append-only log.

## Coverage

The feed covers every sealed package version Seal publishes, across every supported ecosystem. There is no separate enrollment for inclusion in the feed; if a package is sealed, it is in the feed.

## Related

* [VEX records](/integrations/external-scanners/vex-records.md): the per-package machine-readable counterpart.
* [Trivy](/integrations/external-scanners/trivy.md), [Wiz](/integrations/external-scanners/wiz.md): the scanners that consume the feed today.