> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/internal-scanners/ghas.md).

# GitHub Advanced Security (GHAS) integration

<figure><img src="/files/TTXSj6klpPbwfdNYcZm1" alt="GitHub Advanced Security (GHAS)" width="100"><figcaption></figcaption></figure>

The Seal CLI calls the GitHub Dependabot alerts API after every `seal fix` run and dismisses the corresponding alerts on the target repository. Dependabot is the path GitHub exposes for managing the SCA alerts that appear under GHAS.

## Before you start

* A GitHub personal access token (PAT) with the `repo:security_events` scope (read, write, and dismiss security alerts).
* The GitHub organization name and the repository name that owns the alerts.
* If you are running self-hosted GitHub Enterprise Server, the URL of your Dependabot endpoint.

## Configuration

Set these in your CI environment:

```bash
SEAL_DEPENDABOT_URL=https://api.github.com
SEAL_DEPENDABOT_TOKEN=<github pat with repo:security_events>
SEAL_DEPENDABOT_OWNER=<github organization name>
SEAL_DEPENDABOT_REPO=<github repository name>
```

`SEAL_DEPENDABOT_URL` defaults to `https://api.github.com` if omitted. Override it to point at your GitHub Enterprise Server instance.

Or in `.seal-config.yml` at the project root:

```yaml
dependabot:
  url: https://api.github.com
  token: <github pat with repo:security_events>
  owner: <github organization name>
  repo: <github repository name>
```

## How alerts are dismissed

Dependabot creates a single alert for different vulnerable versions of the same package. If your project is affected by more than one vulnerable version of the same package (only possible in certain ecosystems), Seal dismisses the alert only when **all** of those vulnerable versions have been sealed.

## Verify

After a `seal fix` run with the integration configured, open the targeted repository's **Security > Dependabot alerts** view. Alerts Seal dismissed should appear as dismissed with a Seal-attributed reason.

## Related

* [How CLI-driven sync works](/integrations/internal-scanners/how-cli-sync-works.md)
* [The Seal GitHub App](/integrations/github/github-app.md): the source-control integration, separate from this scanner integration.