> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/legacy-documentation/cli-integration/step-by-step-setup-guide.md).

# Step-by-Step Setup Guide

This guide walks you through the initial account setup, token generation, and connecting your first project to Seal Security.

### Account Creation & Token Generation

Follow these steps to access the platform and prepare your environment.

1. **Access the Invite:** Click on the **Sign in >** button in the Seal Security invite email you received.
2. **Log In:** Log in to the platform using your password or social login credentials.
3. **Start Onboarding:** We're starting the onboarding flow. Click **Next >** to begin.

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FBzhr2pbVfNjzMQgOJ5Xk%2F1.png?alt=media&amp;token=de89e2c9-dc56-4656-adbc-c1a761b91cbc" alt="" width="375"><figcaption></figcaption></figure>
4. **Generate Artifact Server Token:** First, you must generate a token to Seal's artifact server. This allows you to download our sealed versions.

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2Fw2xJOVWGfqVJRtwFshEe%2F2.png?alt=media&amp;token=0cceda78-8689-4ded-bbdd-9a6d20f74705" alt="" width="375"><figcaption></figcaption></figure>

   * **a. Generate:** Click on **Generate token**.
   * **b. Copy:** Copy the newly generated token using the copy icon at the right of the text box.

     > **Important:** You will need this token later. While it should eventually be saved in a secure location (like a password manager or secret store), copy it now for immediate use in the next steps.
   * **c. Download CLI:** Download the appropriate CLI binary for your machine:
     * Mac (Apple Silicon)
     * Mac (Intel)
     * Linux
   * **d. Continue:** Click **Next >**.
5. [Click **Maybe later** to skip the GitHub integration.](#user-content-fn-1)[^1]
6. **View Protection Page:** You will land on the **Protection** screen.

   * **Status:** Since no projects are connected yet, we are not showing any results.
   * **Next Step:** We are now going to populate this data using the CLI.

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FqUsDbCDOaT1nGgD0REvo%2F4.png?alt=media&amp;token=7760d67a-c63c-4043-847d-cf6bf145f940" alt="" width="375"><figcaption></figcaption></figure>

### [Connect Your ](#user-content-fn-2)[^2]Codebase

1. Click **Next >** and then click on **GitHub**.
2. **Grant Access & Install Bot:** You need to give the Seal Security Bot access to the relevant repositories:

   1. Connect to your GitHub account.
   2. Install the Seal Security Bot. In this screen, you will be asked to select the relevant GitHub organization, and then decide whether to give the Seal app access to **all its repositories** or to **select specific ones**.
   3. After you've selected which repositories you're giving access to, you'll return to the onboarding flow.

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FA0CniZ1wNQExZ3tDMCoM%2F5.png?alt=media&amp;token=6a579329-ddd5-4fc3-beb8-bd6fe64ff766" alt="" width="375"><figcaption></figcaption></figure>
3. Choose your import method: **Automatic (Bulk)** or **Manual (One-by-one)**.

   **Path A1: Manual Import**

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FY7lZajPSXf3okHxTFUcV%2F6.png?alt=media&amp;token=33363476-34f0-4a8a-a26d-55fd29f37d41" alt="" width="375"><figcaption></figcaption></figure>

   1. Paste the path to your repository. You can add up to 3 repositories at once.
   2. Give each repository a name.
   3. Click **Import**.

   **Path A2: Automatic (Bulk) Import**

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FHAI3yF2sjde5Cb9RbnM7%2F7.png?alt=media&amp;token=f9fec6a6-19c1-48b6-81cc-0b1bdd07fd5c" alt="" width="375"><figcaption></figcaption></figure>

   1. Review the list of dependency files detected in your repository.
   2. Select the specific dependency files you wish to scan.
   3. Click **Import**.
4. **View Protection Page:** After importing, you will land on the **Projects** page.

> **Note:** Each dependency file generates its own "Project" on the Seal platform. It may take some time for Seal to scan the dependency files.

### Integrate the Seal CLI

To start fixing vulnerabilities (and populate the Protection page), you must integrate the CLI into your build pipeline.

**The Golden Rule:** In all cases, the CLI step must be added **immediately after** dependencies are pulled/installed (from standard registries or your artifact server) but **before** the final build/compilation.

**Important Configuration:** For all integration methods, you must ensure the following environment variables are set:

* `SEAL_TOKEN`: The token you generated earlier.
* `SEAL_PROJECT`: The ID of your project on the Seal platform (e.g., "poc").

[Add the `seal fix` command (using the CLI you downloaded in Part 1) as a shell execution step.](#user-content-fn-3)[^3]

* [**npm**](#user-content-fn-4)[^4]

  <pre><code>npm install
  # &#x3C;--- Run Seal CLI Here
  export SEAL_TOKEN=&#x3C;your-token>
  export SEAL_PROJECT="poc"
  <a data-footnote-ref href="#user-content-fn-5">export SEAL_USED_SEAL_NAMES=1</a>
  seal fix --mode <a data-footnote-ref href="#user-content-fn-6">all</a> -vvvv package-lock.json
  npm run build
  </code></pre>
* **pnpm**

  ```
  pnpm install
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv pnpm-lock.yaml
  pnpm run build
  ```
* **yarn**

  ```
  yarn install
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv yarn.lock
  yarn run build
  ```
* **Maven**

  ```
  # Resolve dependencies first
  mvn dependency:resolve
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv pom.xml
  mvn package
  ```
* **Gradle**

  ```
  ./gradlew dependencies
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv build.gradle
  ./gradlew build
  ```
* **pip (Python)**

  ```
  pip install -r requirements.txt
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv requirements.txt
  # (Proceed to run application or build wheel)
  ```
* **Poetry (Python)**

  ```
  poetry install
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv poetry.lock
  poetry build
  ```
* **Go**

  ```
  go mod download
  # <--- Run Seal CLI Here
  export SEAL_TOKEN=<your-token>
  export SEAL_PROJECT="poc"
  export SEAL_USED_SEAL_NAMES=1
  seal fix --mode all -vvvv go.mod
  go build
  ```

[Use the official Seal Security Action. Insert the step `uses: seal-security/seal-action` at the correct point in your `.github/workflows/main.yml`.](#user-content-fn-7)[^7]

Ensure you have added your token to the repository secrets as `SEAL_TOKEN`.

[**npm**](#user-content-fn-8)[^8]

```
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npm install

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv package-lock.json'

- run: npm run build
```

**pnpm**

```
- uses: actions/checkout@v3
- uses: pnpm/action-setup@v2
- run: pnpm install

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv pnpm-lock.yaml'

- run: pnpm run build
```

**yarn**

```
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: yarn install

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv yarn.lock'

- run: yarn run build
```

**Maven**

```
- uses: actions/checkout@v3
- uses: actions/setup-java@v3
  with:
    distribution: 'temurin'
    java-version: '17'
- run: mvn dependency:resolve

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv pom.xml'

- run: mvn package
```

**Gradle**

```
- uses: actions/checkout@v3
- uses: actions/setup-java@v3
  with:
    distribution: 'temurin'
    java-version: '17'
- run: ./gradlew dependencies

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv build.gradle'

- run: ./gradlew build
```

**pip (Python)**

```
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
- run: pip install -r requirements.txt

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv requirements.txt'

# Proceed to run tests or build
```

**Poetry (Python)**

```
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
- run: pip install poetry
- run: poetry install

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv poetry.lock'

- run: poetry build
```

**Go**

```
- uses: actions/checkout@v3
- uses: actions/setup-go@v4
- run: go mod download

- name: Run Seal Fix
  uses: seal-security/seal-action@v1
  env:
    SEAL_PROJECT: 'poc'
    SEAL_USED_SEAL_NAMES: '1'
  with:
    token: ${{ secrets.SEAL_TOKEN }}
    args: '--mode all -vvvv go.mod'

- run: go build -v ./...
```

[If you build inside Docker, add a `RUN` command for the Seal CLI. **Note:** You must ensure the Seal CLI is available inside the container (either `COPY` it in or `wget` it) and that the `SEAL_TOKEN` is available as a build argument.](#user-content-fn-9)[^9]

[**npm**](#user-content-fn-8)[^8]

```
# 1. Install dependencies
RUN npm install

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv package-lock.json

# 3. Build
RUN npm run build
```

**pnpm**

```
# 1. Install dependencies
RUN pnpm install

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv pnpm-lock.yaml

# 3. Build
RUN pnpm run build
```

**yarn**

```
# 1. Install dependencies
RUN yarn install

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv yarn.lock

# 3. Build
RUN yarn run build
```

**Maven**

```
# 1. Resolve dependencies
RUN mvn dependency:resolve

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv pom.xml

# 3. Package
RUN mvn package
```

**Gradle**

```
# 1. Resolve dependencies
RUN ./gradlew dependencies

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv build.gradle

# 3. Build
RUN ./gradlew build
```

**pip (Python)**

```
# 1. Install dependencies
RUN pip install -r requirements.txt

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv requirements.txt

# 3. Entrypoint
CMD ["python", "app.py"]
```

**Poetry (Python)**

```
# 1. Install dependencies
RUN poetry install

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv poetry.lock

# 3. Build/Run
RUN poetry build
```

**Go**

```
# 1. Download modules
RUN go mod download

# 2. Run Seal Fix
ARG SEAL_TOKEN
ENV SEAL_TOKEN=$SEAL_TOKEN
ENV SEAL_PROJECT="poc"
ENV SEAL_USED_SEAL_NAMES=1
RUN ./seal fix --mode all -vvvv go.mod

# 3. Build
RUN go build -o /app/main .
```

#### [Snyk Integration](#user-content-fn-10)[^10]

```
export SEAL_SNYK_URL="https://api.snyk.io" # Default
export SEAL_SNYK_TOKEN="<Snyk access token>"
export SEAL_SNYK_ORG_ID="<ID of your Snyk organization>"
export SEAL_SNYK_PROJECT_ID="<ID of the Snyk project that is scanned>"
```

#### BlackDuck Integration

<pre><code>export SEAL_BLACKDUCK_URL="<a data-footnote-ref href="#user-content-fn-11">&#x3C;Black Duck server's URL></a>"
export SEAL_BLACKDUCK_TOKEN="&#x3C;Black Duck access token>"
export SEAL_BLACKDUCK_PROJECT="&#x3C;Name of the project on Black Duck>"
export SEAL_BLACKDUCK_PROJECT_VERSION_NAME="&#x3C;Git branch that is scanned>"
</code></pre>

#### GitHub Advanced Security / Dependabot

<pre><code>export SEAL_DEPENDABOT_URL="<a data-footnote-ref href="#user-content-fn-12">&#x3C;Dependabot server's URL></a>"
export SEAL_DEPENDABOT_TOKEN="&#x3C;Dependabot access token>"
export SEAL_DEPENDABOT_OWNER="&#x3C;Name of the GitHub organization>"
export SEAL_DEPENDABOT_REPO="&#x3C;Name of the GitHub repository>"
</code></pre>

#### Ox Security

```
export SEAL_OX_URL="https://api.cloud.ox.security/api/apollo-gateway"
export SEAL_OX_TOKEN="<Ox access token>"
export SEAL_OX_APPLICATION="<Name of the Ox application>"
export SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED="true"
```

### Next Steps

Once you have integrated the CLI into your pipeline, follow these steps to see the results.

1. **Trigger the Pipeline:** Run your build pipeline (Jenkins job, GitHub Action workflow, or Docker build). This execution will trigger the `seal fix` command, which scans your dependencies and reports back to the Seal Platform.
2. **View the Protection Page:** Navigate to the [Protection Page](https://app.sealsecurity.io/protection/vulnerable).

   * If the page is already open and empty, refresh it. You should now see a list of detected vulnerabilities.

   <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FQ20EK8aoO29wYqSzzgJb%2Fimage.png?alt=media&amp;token=22de12a7-2ab2-46e9-a7ca-3bf8d28ec319" alt="" width="563"><figcaption></figcaption></figure>
3. **Remediate Vulnerabilities:** Now that we have visibility, let's look at how fixes are applied based on the mode you selected.
   * **If you chose `mode: all`:** The initial run of the `seal fix` command has likely already replaced vulnerable packages.
     * **Fixed:** Vulnerabilities we successfully patched will appear with a green **Sealed** label on the right side of the row.
     * **Pending:** For packages where a sealed version doesn't exist yet, you will see a **Generate Fix** button.
   * **If you chose `mode: remote`:** No code changes happen automatically. You have full control via the UI.
     * **Available Fixes:** Packages with a ready-to-use sealed version will show a blue **Seal** button.
     * **Action:** Click the **Seal** button, then confirm by clicking **Seal package** in the dialog box. This creates a sealing rule on the server.<br>

       <figure><img src="https://2109738374-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FytkIsVkwVdKiLQ2CT6Sw%2Fuploads%2FeLqtypr4nOhj3jOlJEOe%2Fimage.png?alt=media&amp;token=98daeb5f-3db1-45a4-9986-7bac97da1fbe" alt="" width="375"><figcaption></figcaption></figure>
     * **Apply:** Run your pipeline again. The CLI will now pick up the new rule, replace the package, and the status in the UI will change to a green **Sealed** label.
     * **Pending:** Packages without an existing sealed version will show a **Generate Fix** button.
   * **If you chose `mode: local`:** *Instructions for local mode configuration will be provided separately.*

### Configure the Artifact Server

To pull sealed versions, you must configure your environment to trust and prioritize Seal's repository. Choose the scenario that matches your infrastructure.

#### Scenario A: No Private Artifact Server

*Use this method if your developers/CI pull directly from public registries (npm, PyPI, Maven Central, etc.).*

You will either add Seal as an additional registry or set it as the default registry, depending on the package manager's capabilities. Seal proxies all upstream traffic, ensuring standard packages are also available.

**Prerequisites:** In all configurations below, you will need the following values:

* **`$SEAL_TOKEN`**: The Access Token you generated in the onboarding flow.
* **`$SEAL_PROJECT`**: Your Project ID (e.g., `poc`). This is used for reporting usage.

**npm & Yarn Classic (v1)**

We recommend using a per-project configuration by creating or editing the `.npmrc` file in your project's root directory.

**Configuration Steps:**

1. **Prepare your credentials:**
   * **Project Identifier (`$SEAL_PROJECT`):** e.g., `poc`.
   * **Base64 Token:** You must encode your Seal Access Token (`$SEAL_TOKEN`) in base64.
     * **macOS:** `echo -n $SEAL_TOKEN | base64`
     * **Linux (Ubuntu):** `echo -n $SEAL_TOKEN | base64 -w0`
2. **Edit `.npmrc`:** Add the following content to replace the default registry with Seal Security.

   ```
   registry=[https://npm.sealsecurity.io/](https://npm.sealsecurity.io/)
   //npm.sealsecurity.io/:username=$SEAL_PROJECT
   //npm.sealsecurity.io/:_password=<YOUR_BASE64_TOKEN>
   //npm.sealsecurity.io/:always-auth=true
   ```
3. **Verify:** Run the following command to check authentication:

   ```
   npm -d ping
   ```

   *Success Output:* `npm notice PONG ... npm info ok`

**Yarn v2**

The configuration is saved in the `.yarnrc.yml` file in the project's root.

**Configuration Steps:**

1. **Prepare your Authentication String:** You must Base64 encode the string `$SEAL_PROJECT:$SEAL_TOKEN`.
2. **Edit `.yarnrc.yml`:** Set the following configuration, replacing `<BASE64_STRING>` with your encoded credentials.

   ```
   npmRegistries:
     "https://npm.sealsecurity.io":
       npmAlwaysAuth: true
       npmAuthIdent: "<BASE64_STRING>"

   npmRegistryServer: "https://npm.sealsecurity.io"
   ```
3. **Check Yarn Path:** Ensure `yarnPath` in the file points to the correct version (e.g., `.yarn/releases/yarn-{version}.cjs`).

**Yarn v3+**

The configuration is saved in the `.yarnrc.yml` file in the project's root.

**Configuration Steps:**

1. **Prepare your Authentication String:** Use the plain string `"$SEAL_PROJECT:$SEAL_TOKEN"`. No encoding is required.
2. **Edit `.yarnrc.yml`:** Add the following configuration.

   ```
   npmRegistries:
     "https://npm.sealsecurity.io":
       npmAlwaysAuth: true
       npmAuthIdent: "$SEAL_PROJECT:$SEAL_TOKEN"

   npmRegistryServer: "https://npm.sealsecurity.io"
   ```
3. **Check Yarn Path:** Ensure `yarnPath` in the file points to the correct version (e.g., `.yarn/releases/yarn-{version}.cjs`).

**pip**

Configure `pip` to check Seal as an **additional registry** (`extra-index-url`).

**Option 1: Command Line / CI**

Use an environment variable to configure the extra index URL globally for the session.

```
export PIP_EXTRA_INDEX_URL=https://$SEAL_PROJECT:$SEAL_TOKEN@pypi.sealsecurity.io/simple
```

**Option 2: pip.conf (Global/User config)**

```
[global]
extra-index-url = https://$SEAL_PROJECT:$SEAL_TOKEN@pypi.sealsecurity.io/simple
```

**Option 3: requirements.txt**

Add the following line to the top of your `requirements.txt` file.

```
--extra-index-url https://$SEAL_PROJECT:$SEAL_TOKEN@pypi.sealsecurity.io/simple
```

**Poetry**

Configure the Seal repository in your `pyproject.toml` or via CLI configuration.

1. **Add Repository:**

   ```bash
   poetry source add --default seal https://$SEAL_PROJECT:$SEAL_TOKEN@pypi.sealsecurity.io/simple
   ```
2. **Usage:** Poetry will now query this repository when resolving dependencies.

**Maven**

We recommend defining the repository in your project's `pom.xml` and configuring authentication securely via your global `settings.xml`.

**Step 1: Edit `pom.xml`** Open the project's `pom.xml` file. Add the Seal Security repository inside the `<repositories>` tag. If the tag doesn't exist, create it. *Note: Ensure Seal is the first repository listed.*

```xml
<repositories>
  <repository>
    <id>seal-security</id>
    <url>https://maven.sealsecurity.io/</url>
    <releases><enabled>true</enabled></releases>
    <snapshots><enabled>false</enabled></snapshots>
  </repository>
</repositories>
```

**Step 2: Edit `settings.xml`** Open your Maven settings file (usually `~/.m2/settings.xml` on Unix/Mac or `%userprofile%\.m2\settings.xml` on Windows). Add a `<server>` entry to the `<servers>` section. *Important: The `<id>` must match the repository ID used in Step 1.*

```xml
<settings>
  <servers>
    <server>
      <id>seal-security</id>
      <username>${env.SEAL_PROJECT}</username>
      <password>${env.SEAL_TOKEN}</password>
    </server>
  </servers>
</settings>
```

**Step 3: Build** When building your project, pass the project ID and token as environment variables.

```bash
# Make sure SEAL_PROJECT and SEAL_TOKEN are exported in your shell first
SEAL_PROJECT=$SEAL_PROJECT SEAL_TOKEN=$SEAL_TOKEN mvn package
```

**Gradle**

Add the Seal repository to your `build.gradle` file.

```
repositories {
    maven {
        url "https://maven.sealsecurity.io"
        credentials {
            username = $SEAL_PROJECT
            password = $SEAL_TOKEN
        }
    }
}
```

**Go**

The Go repository is managed via the `GOPROXY` environment variable.

Before building the project or downloading modules, you must set `GOPROXY` to point to Seal Security. You must embed your Project ID and Token directly into the URL for authentication.

```
# Replace $SEAL_PROJECT with your Project ID and $SEAL_TOKEN with your token

GOPROXY="https://$SEAL_PROJECT:$SEAL_TOKEN@go.sealsecurity.io,direct" go mod download
```

**Nuget**

Add Seal as a package source in your `nuget.config` file.

```
<configuration>
  <packageSources>
    <add key="Seal" value="https://nuget.sealsecurity.io/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <Seal>
      <add key="Username" value="%SEAL_PROJECT%" />
      <add key="ClearTextPassword" value="%SEAL_TOKEN%" />
    </Seal>
  </packageSourceCredentials>
</configuration>
```

*Note: Ensure you replace* `%SEAL_PROJECT%` *and `%SEAL_TOKEN%` with appropriate environment variable references or values.*

**Bundler**

Configure Bundler to use Seal Security as a mirror or source.

**Gemfile Configuration:** You can specify the source directly in your `Gemfile`:

```
source "https://#{ENV['SEAL_PROJECT']}:#{ENV['SEAL_TOKEN']}@ruby.sealsecurity.io
```

**Composer (PHP)**

Add the Seal repository to your `composer.json` file and configure authentication in `auth.json`.

```
# Configure the repository
composer config repos.packagist composer https://packagist.sealsecurity.io/

# Configure the authentication method
composer config --auth http-basic.packagist.sealsecurity.io $SEAL_PROJECT $SEAL_TOKEN
```

**APK**

1. Download the Seal artifact server public key file:

{% file src="/files/jmSVhbLaCQ3TMVNmOEj0" %}

1. Save the file in `/etc/apk/keys/sealsecurity.rsa.pub` .
2. Edit `/etc/apk/repositories`. Add the Seal repository line at the top:

```
https://$SEAL_PROJECT:$SEAL_TOKEN@apk.sealsecurity.io/seal/main
```

**APT**

Create a file `/etc/apt/sources.list.d/seal.list`:

```
deb https://$SEAL_PROJECT:$SEAL_TOKEN@apt.sealsecurity.io/debian/ <distribution> main
```

**YUM**

Create a file `/etc/yum.repos.d/seal.repo`:

```
[seal-security]
name=Seal
baseurl=https://rpm.sealsecurity.io/centos/$releasever/os/$basearch/
enabled=1
gpgcheck=0
username=$SEAL_PROJECT
password=$SEAL_TOKEN
```

#### Scenario B: Using JFrog Artifactory

*Use this method if you manage dependencies via JFrog Artifactory.*

You will create a **Remote Repository** in Artifactory that points to the Seal Artifact Server, and then add it to your Virtual Repository. Since Seal proxies upstream traffic, it functions as a fully capable remote source.

1. **Create Remote Repository:**
   * **Package Type:** Select the relevant type (npm, PyPI, Maven, Go).
   * **Repository Key:** e.g., `seal-npm-remote`.
   * **URL:** Enter the Seal Registry URL (e.g., `https://npm.sealsecurity.io`).
   * **Authentication:**
     * **User Name:** `token` (or as specified in the Seal dashboard).
     * **Password / Access Token:** Paste your Seal Artifact Server Token.
2. **Update Virtual Repository:**
   * Go to your main Virtual Repository (e.g., `npm-virtual`).
   * Add the new `seal-npm-remote` repository to the list of aggregated repositories.
   * **Priority:** Ensure the Seal repository is higher in the resolution order than the public repositories (npm, Maven Central) to ensure sealed versions are found.

#### Scenario C: Other / Manual

*Use this method for air-gapped environments or other artifact servers (Nexus, Azure Artifacts) without remote proxy capabilities.*

1. **Download:** Go to the Seal Protection page, locate the package, and click **Download Artifact**.
2. **Upload:** Manually upload the `.tgz`, `.whl`, or `.jar` file to your private artifact server.

### Part 4: How to Apply Fixes

Once the server is configured, you must explicitly update your dependency files to use the sealed versions.

#### 1. npm / yarn / pnpm

* **Direct Dependency:** Update the version in `package.json`.

  ```
  npm install package-name@1.2.3-sp1
  ```
* **Transitive Dependency (Force Resolution):**
  * **npm (v8+) / pnpm:** Use the `overrides` field in `package.json`.

    ```
    {
      "overrides": {
        "vulnerable-package": "1.2.3-sp1"
      }
    }
    ```
  * **yarn:** Use the `resolutions` field in `package.json`.

    ```
    {
      "resolutions": {
        "vulnerable-package": "1.2.3-sp1"
      }
    }
    ```

#### 2. Maven

* **Direct Dependency:** Update the `<version>` tag in your `pom.xml`.

  ```
  <dependency>
      <groupId>com.example</groupId>
      <artifactId>vulnerable-lib</artifactId>
      <version>1.2.3-sp1</version>
  </dependency>
  ```
* **Transitive Dependency:** Use the `<dependencyManagement>` section in your `pom.xml` to enforce a version across the entire project.

  ```
  <dependencyManagement>
      <dependencies>
          <dependency>
              <groupId>com.example</groupId>
              <artifactId>transitive-lib</artifactId>
              <version>1.2.3-sp1</version>
          </dependency>
      </dependencies>
  </dependencyManagement>
  ```

#### 3. Python (pip)

* **Direct Dependency:** Update the line in `requirements.txt`.

  ```
  vulnerable-package==1.2.3-sp1
  ```
* **Transitive Dependency:** Add the transitive package explicitly to your `requirements.txt` to override the sub-dependency resolution.

  ```
  # Explicitly pinning transitive dependency to sealed version
  transitive-package==1.2.3-sp1
  ```

#### 4. Go

* **Direct Dependency:** Get the specific sealed version.

  ```
  go get [example.com/vulnerable-module@v1.2.3-sp1](https://example.com/vulnerable-module@v1.2.3-sp1)
  ```
* **Transitive Dependency:** Use the `replace` directive in your `go.mod` file.

  ```
  replace [example.com/transitive-module](https://example.com/transitive-module) => [example.com/transitive-module](https://example.com/transitive-module) v1.2.3-sp1
  ```

```
    <activeProfile>seal-repo</activeProfile>
  </activeProfiles>
</settings>
```

**4. Go**

Add Seal to your `GOPROXY` list as an **additional proxy**, prioritizing it before the public proxy.

```
export GOPROXY=[https://go.sealsecurity.io](https://go.sealsecurity.io),proxy.golang.org,direct
```

####

[^1]: Steps 5 and 6 should appear only if we're not connecting to GitHub.

[^2]: Only if they want to connect to GitHub

[^3]: Only if they're using a CI tool like Jenkins.

[^4]: Add the appropriate ecosystem only.

[^5]: Only when relevant

[^6]: The mode should obviously be configurable according to the flow we're in.

[^7]: This section only if they're using a GitHub action.

[^8]: Only add the relevant ecosystem.

[^9]: Only for Dockerfiles

[^10]: We should incorporate these as the environment variables if they use them.

[^11]: Not sure what the default it

[^12]: Not sure what the default is