> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/introduction/product-family/seal-apps.md).

# Seal Apps

Sealed packages for your application's third-party open-source dependencies.

**Seal Apps** remediates vulnerabilities in your application's third-party open-source dependencies. The packages your code pulls in directly, and the packages those packages pull in transitively, are replaced with sealed versions of the same origin versions.

<figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2Fgit-blob-459a903beaebf9da11d14892e81af18b5ef8cc17%2Fseal-apps-ecosystems.png?alt=media" alt="Some of the language ecosystems Seal Apps covers: JavaScript, Python, Java, Go, Ruby"><figcaption></figcaption></figure>

## What it covers

Application-dependency ecosystems:

* **JavaScript:** npm, Yarn, pnpm
* **Python:** pip, Poetry
* **Java:** Maven, Gradle
* **Go:** Go modules
* **PHP:** Composer
* **Ruby:** Bundler
* **.NET:** NuGet

Seal Apps does not cover language runtimes themselves (the Node.js binary, the Python interpreter, the JVM, the .NET CLR). Those are handled by [Seal OS](/introduction/product-family/seal-os.md) when installed via OS package managers, or by [Seal Base Images](/introduction/product-family/seal-base-images.md), [Seal My Container](/introduction/product-family/seal-my-container.md), or [Seal Vendor Apps](/introduction/product-family/seal-vendor-apps.md) when bundled in container images.

Python packages that the OS package manager installed are also out of scope. On a Linux image, `apt`, `dnf`, and `apk` ship Python packages of their own (for example `python3-jinja2`), and the OS package manager owns both their versioning and their fix, so the Seal CLI's Python scan passes over them. They are covered by [Seal OS](/introduction/product-family/seal-os.md) instead.

## How it is delivered

Seal Apps uses [build-time dependency sealing](/introduction/seal-approach/sealing-approaches.md). It supports several deployment methods:

* The **Seal CLI in your CI/CD pipeline** (recommended). The CLI ensures that sealed versions are used in place of vulnerable origin versions; your build proceeds as before, and the artifact you ship incorporates the sealed dependencies.
* The **Seal Artifact Server** as a configured remote (or as an additional remote) in your package manager.
* **Manual download** of sealed versions directly from the Repository page.

## Related

* [Choosing your deployment method](/setup-apps-os/choosing-deployment-method.md): day-1 setup options for Seal Apps.
* [Working with Seal Apps](/using-platform/working-with-seal-apps.md): the day-to-day workflow.