> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/internal-scanners/ox-security.md).

# Ox Security integration

<figure><img src="/files/9YOjJcieqmkEiR0k5g8m" alt="Ox Security" width="140"><figcaption></figcaption></figure>

The Seal CLI calls the Ox API after every `seal fix` run and updates the corresponding alerts on the targeted Ox application.

## Before you start

* An Ox API token with permissions to update findings on the target application.
* The Ox application name as registered in your Ox tenant.
* The Ox API endpoint (typically `https://api.cloud.ox.security/api/apollo-gateway` for the hosted tenant).

## Configuration

Set these in your CI environment:

```bash
SEAL_OX_URL=https://api.cloud.ox.security/api/apollo-gateway
SEAL_OX_TOKEN=<ox api token>
SEAL_OX_APPLICATION=<ox application name>
```

Or in `.seal-config.yml` at the project root:

```yaml
ox:
  url: https://api.cloud.ox.security/api/apollo-gateway
  token: <ox api token>
  application: <ox application name>
```

## How alerts are updated

Ox groups vulnerabilities by direct dependency: a single Ox alert can cover multiple vulnerabilities flowing through the same direct dependency. Seal's default behavior reflects that grouping:

* For each Ox alert that covers a set of vulnerabilities, Seal adds a comment listing which of those vulnerabilities it has sealed and which remain open.
* Seal lowers the alert's priority to match the highest-severity vulnerability still open in that alert.
* The alert is not closed until all vulnerabilities covered by it are sealed.

This conservative default reflects the fact that an Ox alert still carries open vulnerabilities even when some have been sealed.

### Closing alerts once high and critical are sealed

If your organization's policy is to close an alert once its high and critical vulnerabilities are remediated (regardless of remaining medium / low), set the additional flag:

```bash
SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED=true
```

Or in `.seal-config.yml`:

```yaml
ox:
  exclude-when-high-critical-fixed: true
```

With this set, Seal closes the Ox alert when every high- and critical-severity vulnerability in it has been sealed, even if medium- or low-severity vulnerabilities remain.

## Verify

After a `seal fix` run with the integration configured, open the targeted Ox application. Affected alerts should carry a Seal-attributed comment listing sealed vulnerabilities and, where applicable, a lowered priority or a closed status.

## Related

* [How CLI-driven sync works](/integrations/internal-scanners/how-cli-sync-works.md)