> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/cli/environment-variables.md). # Environment variables All environment variables the Seal CLI reads use the prefix `SEAL_`. Each variable also has a YAML counterpart in `.seal-config.yml`; environment variables take precedence over YAML. ## Core | Variable | YAML key | Default | Meaning | | ----------------------- | ------------------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `SEAL_TOKEN` | `token` | none | Authentication token to the Seal Artifact Server. Generated in the Seal UI. | | `SEAL_PROJECT` | `project` | none | The Seal Project this run reports to. | | `SEAL_USE_SEALED_NAMES` | `use-sealed-names` | `false` | When `true`, sealed packages are installed under their `seal-`-prefixed names. See [Renamed packages](/reference/naming-and-versioning/renamed-packages.md). | ## Per-ecosystem These are optional. They shape how the CLI interacts with each ecosystem's package manager. ### npm | Variable | YAML key | Meaning | | ----------------------- | ----------------------- | ------------------------------------- | | `SEAL_NPM_PROD_ONLY` | `npm.prod-only` | Only scan production dependencies. | | `SEAL_NPM_IGNORE_EXTRA` | `npm.ignore-extraneous` | Ignore packages marked as extraneous. | ### pnpm | Variable | YAML key | Meaning | | --------------------- | ---------------- | ---------------------------------- | | `SEAL_PNPM_PROD_ONLY` | `pnpm.prod-only` | Only scan production dependencies. | ### Maven | Variable | YAML key | Meaning | | ----------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------- | | `SEAL_MAVEN_PROD_ONLY` | `maven.prod-only` | Only scan production dependencies. | | `SEAL_MAVEN_CACHE_PATH` | `maven.cache-path` | Custom local Maven cache folder. | | `SEAL_MAVEN_RENAME_IN_POM` | `maven.rename-in-pom` | Rename sealed packages in POM files. | | `SEAL_MAVEN_COPY_ENTIRE_M2_CACHE` | `maven.copy-entire-m2-cache` | Copy the entire `.m2` cache instead of only the project's dependencies. | | `SEAL_MAVEN_SKIP_DIRECTORY_CHANGES` | `maven.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_MAVEN_UPDATE_CLASS_METADATA` | `maven.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Gradle | Variable | YAML key | Meaning | | ------------------------------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `SEAL_GRADLE_PROD_ONLY` | `gradle.prod-only` | Only scan production dependencies. | | `SEAL_GRADLE_HOME_PATH` | `gradle.home-path` | Custom Gradle home for a private cache (must be absolute). | | `SEAL_GRADLE_SKIP_DIRECTORY_CHANGES` | `gradle.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_GRADLE_UPDATE_CLASS_METADATA` | `gradle.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Java files | Variable | YAML key | Meaning | | ---------------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `SEAL_JAVA_FILES_SKIP_DIRECTORY_CHANGES` | `java-files.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_JAVA_FILES_UPDATE_CLASS_METADATA` | `java-files.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Python | Variable | YAML key | Meaning | | ------------------------------------- | -------------------------------- | ------------------------------------------------------------- | | `SEAL_PYTHON_ONLY_BINARY` | `python.only-binary` | Only install `.whl` artifacts, no source. | | `SEAL_PYTHON_DELETE_FROM_WHEEL_CACHE` | `python.delete-from-wheel-cache` | Delete vulnerable wheels from the global pip cache after fix. | ### Composer (PHP) | Variable | YAML key | Meaning | | ---------------------------- | -------------------- | ---------------------------------- | | `SEAL_PHPCOMPOSER_PROD_ONLY` | `composer.prod-only` | Only scan production dependencies. | ### Bundler (Ruby) | Variable | YAML key | Meaning | | ------------------------ | ------------------- | ---------------------------------- | | `SEAL_BUNDLER_PROD_ONLY` | `bundler.prod-only` | Only scan production dependencies. | ### RPM | Variable | YAML key | Meaning | | ------------------------- | -------------------- | ----------------------------------------------- | | `SEAL_RPM_NO_GPG_INSTALL` | `rpm.no-gpg-install` | Skip GPG signature verification during install. | ### Go | Variable | YAML key | Meaning | | -------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `SEAL_GOLANG_DONT_CHANGE_GO_MOD` | `golang.dont-change-go-mod` | Keep `go.mod`, `vendor/`, and `modules.txt` unchanged. The vendor folder is sealed; manifests retain origin versions. | ## Scanner integrations ### Snyk | Variable | YAML key | Default | Meaning | | ---------------------- | ------------------ | --------------------- | ------------------------------------------- | | `SEAL_SNYK_URL` | `snyk.url` | `https://api.snyk.io` | Snyk API URL. | | `SEAL_SNYK_TOKEN` | `snyk.token` | none | Snyk service-account token. | | `SEAL_SNYK_ORG_ID` | `snyk.org-id` | none | Snyk organization ID. | | `SEAL_SNYK_PROJECT_ID` | `snyk.project-ids` | none | Snyk project ID, or a comma-separated list. | ### Black Duck | Variable | YAML key | Meaning | | ------------------------------------- | -------------------------------- | -------------------------------- | | `SEAL_BLACKDUCK_URL` | `blackduck.url` | Black Duck server URL. | | `SEAL_BLACKDUCK_TOKEN` | `blackduck.token` | Black Duck access token. | | `SEAL_BLACKDUCK_PROJECT` | `blackduck.project-name` | Black Duck project name. | | `SEAL_BLACKDUCK_PROJECT_VERSION_NAME` | `blackduck.project-version-name` | Black Duck project-version name. | ### GHAS (Dependabot) | Variable | YAML key | Default | Meaning | | ----------------------- | ------------------ | ------------------------ | --------------------------------------- | | `SEAL_DEPENDABOT_URL` | `dependabot.url` | `https://api.github.com` | Dependabot endpoint URL. | | `SEAL_DEPENDABOT_TOKEN` | `dependabot.token` | none | GitHub PAT with `repo:security_events`. | | `SEAL_DEPENDABOT_OWNER` | `dependabot.owner` | none | GitHub organization name. | | `SEAL_DEPENDABOT_REPO` | `dependabot.repo` | none | Repository name. | ### Ox Security | Variable | YAML key | Meaning | | ------------------------------------------ | ------------------------------------- | ------------------------------------------------------------------------------- | | `SEAL_OX_URL` | `ox.url` | Ox API URL. | | `SEAL_OX_TOKEN` | `ox.token` | Ox access token. | | `SEAL_OX_APPLICATION` | `ox.application` | Ox application name. | | `SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED` | `ox.exclude-when-high-critical-fixed` | Close the alert when every high- and critical-severity vulnerability is sealed. | ### Checkmarx | Variable | YAML key | Meaning | | --------------------------- | ---------------------- | --------------------- | | `SEAL_CHECKMARX_URL` | `checkmarx.url` | Checkmarx tenant URL. | | `SEAL_CHECKMARX_TOKEN` | `checkmarx.token` | Checkmarx API token. | | `SEAL_CHECKMARX_PROJECT_ID` | `checkmarx.project-id` | Checkmarx project ID. | ### SentinelOne | Variable | YAML key | Meaning | | ----------------------------- | ------------------------ | --------------------------------------------- | | `SEAL_SENTINELONE_URL` | `sentinelone.url` | SentinelOne tenant URL. | | `SEAL_SENTINELONE_TOKEN` | `sentinelone.token` | SentinelOne API token. | | `SEAL_SENTINELONE_SCOPE_TYPE` | `sentinelone.scope-type` | Scope type (for example, `site`, `account`). | | `SEAL_SENTINELONE_SCOPE_IDS` | `sentinelone.scope-ids` | Comma-separated scope IDs. | | `SEAL_SENTINELONE_TAG` | `sentinelone.tag` | Tag identifying the scanner policy to update. | ## JFrog Artifactory | Variable | YAML key | Default | Meaning | | ---------------------------- | -------------------- | ---------- | ------------------------------------------------------- | | `SEAL_JFROG_ENABLED` | `jfrog.enabled` | `false` | Route the CLI's traffic through JFrog. | | `SEAL_JFROG_AUTH_TOKEN` | `jfrog.token` | none | JFrog reference token. | | `SEAL_JFROG_INSTANCE_HOST` | `jfrog.host` | none | JFrog host (no scheme; for example, `domain.jfrog.io`). | | `SEAL_JFROG_INSTANCE_SCHEME` | `jfrog.scheme` | `https` | URL scheme. | | `SEAL_JFROG_XRAY_ENABLED` | `jfrog.xray-enabled` | `false` | Enable Xray integration. | | `SEAL_JFROG_REPOSITORY` | `jfrog.repository` | none | JFrog repository name. | | `SEAL_JFROG_CLI_REPO` | `jfrog.cli-repo` | `seal-cli` | Repo key for the CLI-backend remote. | | `SEAL_JFROG_MAVEN_REPO` | `jfrog.maven-repo` | `seal-mvn` | Repo key for the Maven-artifacts remote. | ## Related * [Commands](/reference/cli/commands.md), [Global flags](/reference/cli/global-flags.md) * [Internal scanner integrations](/integrations/internal-scanners.md) * [Artifactory integrations](/integrations/artifactory.md)