Renaming non-vulnerable packages
Handle the case where an external scanner is false-positively flagging a non-vulnerable package.
Last updated
Handle the case where an external scanner is false-positively flagging a non-vulnerable package.
The tenant-wide rename described in Renaming sealed packages only touches packages Seal sealed. A separate case comes up when an external scanner is false-positively flagging a package that is not vulnerable in the first place: Seal has no Sealing Rule against it and nothing to substitute, but the scanner still alerts on its presence.
For those packages, the per-package equivalent of renaming exists as a feature on the Seal Platform: a Scanner Exclusion. The mechanism is the same (the CLI installs the package under a prefixed name so the scanner does not match it), but the scope is one package at a time, defined by a record on the Scanner exclusions tab.
Open the Scanner exclusions tab on the Protection page. Create a Scanner Exclusion identifying the Seal Project, the ecosystem, the package name, and the version. The next CLI run for that Seal Project installs the named package version under the seal- prefix; the scanner stops alerting on it.
The full mechanics, including who can create exclusions and the lifecycle of an exclusion, are in the Scanner Exclusions chapter.
Scanner Exclusions: the canonical home for per-package exclusion mechanics.
Renaming sealed packages: the tenant-wide setting for packages Seal sealed.
Last updated