> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/github/github-app.md).

# The Seal GitHub App

The Seal GitHub App is a standard GitHub App that customers install on their organization (or on a selected subset of repositories). Installing it gives the Seal Platform source-side visibility into the repositories you opt in, and unlocks two features that depend on that visibility: source-code package discovery and pull-request flows for the Local fix mode.

## What the App does

* **Discovers packages from your default branch.** For each repository you opt in, Seal reads the manifest files (`package.json`, `requirements.txt`, `pom.xml`, etc.) on the default branch and discovers the third-party packages declared there. Discovered packages appear on the Protection page just as they would from a CLI-based discovery.
* **Opens pull requests for `.seal-actions.yml` updates (Local fix mode only).** For Seal Projects that use the Local fix mode, the App backs two PR flows:

  * **On demand.** From the Projects page, click the PR button next to the project. The App opens a pull request that edits `.seal-actions.yml` to add the relevant entry.
  * **Automatic.** When configured, the App opens a PR each time a new sealed iteration ships for a package the project pins. The PR updates the `.seal-actions.yml` entry to point at the new iteration. Review and merge in your normal flow.

  These flows are specific to Local mode because `.seal-actions.yml` is the Local-mode rule file. Remote and Automatic Remediation modes do not use `.seal-actions.yml`; the App's PR flows are not exercised by those modes.
* **Skips archived repositories.** Repositories archived in GitHub are excluded from scans. The App treats them as if they were not installed.

## What the App does not do

* It does not write to your repository on its own. Every modification opens a pull request that you review and merge.
* It does not run your CI. The CLI step in your CI pipeline still does the actual sealing; the App is responsible for the source-side context and PR flows.
* It does not have any role in the [GHAS integration](/integrations/internal-scanners/ghas.md). The GHAS integration uses a separate GitHub personal access token configured on the Seal CLI, not the App's installation token.

## Permissions

The App requests the minimum set of permissions for the capabilities above. The standard installation flow lists the exact permissions at install time; review them there before clicking **Install**. Customers in source-restricted environments who do not want Seal to read source code at all can skip installing the App entirely and operate the platform through the CLI alone. See the [DevOps audience guide](/introduction/audience-guides/devops-engineer.md) for the privacy framing.

## Where the App's capabilities show up in the UI

* **The Projects page.** The per-project PR button on a Seal Project row uses the App to open a `.seal-actions.yml` PR. Only visible on Local-mode Seal Projects.
* **The Protection page.** Packages discovered through the App appear on the Vulnerable packages tab with their normal row state.
* **Seal Project setup.** When you create a Seal Project from a GitHub repository, the App's installation state determines what discovery modes are offered.

## Installing the App

The walk-through, including the install URL and the per-repository scope-selection screen, lives in [Connecting GitHub](/discovering/connecting-source-control/github.md). That chapter is the primary how-to; this reference page describes what the App does once installed.

## Related

* [Connecting GitHub](/discovering/connecting-source-control/github.md): the install how-to.
* [Working with Seal Apps under Local](/using-platform/working-with-seal-apps/local.md): the rhythm that consumes the PR flows.
* [Connecting GitHub through the Seal Engineer](/using-platform/seal-engineer.md#connecting-github): a separate installation path for the App that runs from inside the Seal Engineer's setup flow.
* [The Seal GitHub Action](/integrations/github/github-action.md): the unrelated Actions step for invoking the CLI from a workflow.