> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/cli/environment-variables.md). # Environment variables Every environment variable the Seal CLI reads, with defaults. All environment variables the Seal CLI reads use the prefix `SEAL_`. Each variable also has a YAML counterpart in `.seal-config.yml`; environment variables take precedence over YAML. ## Core | Variable | YAML key | Default | Meaning | | --------------------------------- | ---------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `SEAL_TOKEN` | `token` | none | Authentication token to the Seal Artifact Server. Generated in the Seal UI. | | `SEAL_PROJECT` | `project` | none | The Seal Project this run reports to. | | `SEAL_PROJECT_NAME` | `project-name` | none | The name of a new Seal Project. When set, the CLI sends this name in place of the name it generates from the manifest, the folder name, or the image. A Seal Project that already exists keeps its name; rename it in the Seal UI. The name can contain letters, digits, underscores, hyphens, periods, and spaces, up to 255 characters; any other value fails the run with an `invalid project-name` error. With `SEAL_USE_GIT_BRANCH_FOR_PROJECT`, the branch is still added to the name. | | `SEAL_USE_GIT_BRANCH_FOR_PROJECT` | `use-git-branch-for-project` | `false` | When `true`, each git branch reports to its own Seal Project. The CLI adds the current branch to the project ID (`_bran_`), including a project ID you set with `SEAL_PROJECT`, and to the name of a new project (`-`). Characters not allowed in a project ID are replaced or dropped (`feature/x` becomes `feature-x`), and the branch is shortened so the ID stays within 255 characters. On a detached HEAD, the usual CI checkout, the CLI reads the branch from the CI environment variables of GitHub Actions, GitLab, Jenkins, Azure Pipelines, Bitbucket and CircleCI. If no branch is found, the project ID does not change. | | `SEAL_USE_SEALED_NAMES` | `use-sealed-names` | `false` | When `true`, sealed packages are installed under their `seal-`-prefixed names. See [Renamed packages](/reference/naming-and-versioning/renamed-packages.md). | | `SEAL_RENAME_IN_MANIFEST` | `rename-in-manifest` | `false` | When `true`, the CLI also rewrites your project's own manifest to the sealed names: the root `package.json` and the dependency references in `package-lock.json` for npm, the root `package.json` and `yarn.lock` (Yarn Classic v1) for Yarn, and `pom.xml` for Maven. Requires `use-sealed-names`. See [Renaming sealed packages](/integrations/package-renaming/renaming-sealed.md). | ## Per-ecosystem These are optional. They shape how the CLI interacts with each ecosystem's package manager. ### npm | Variable | YAML key | Meaning | | ----------------------- | ----------------------- | ------------------------------------- | | `SEAL_NPM_PROD_ONLY` | `npm.prod-only` | Only scan production dependencies. | | `SEAL_NPM_IGNORE_EXTRA` | `npm.ignore-extraneous` | Ignore packages marked as extraneous. | When it lists the installed packages of an npm or Yarn project, the CLI does not read your user-level npm config (`~/.npmrc`), so settings there, such as `omit=dev` or a legacy `_auth`, do not affect the scan. To scan only production dependencies, set `SEAL_NPM_PROD_ONLY`. The project's own `.npmrc` is still read. ### pnpm | Variable | YAML key | Meaning | | --------------------- | ---------------- | ---------------------------------- | | `SEAL_PNPM_PROD_ONLY` | `pnpm.prod-only` | Only scan production dependencies. | ### Maven | Variable | YAML key | Meaning | | ----------------------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------- | | `SEAL_MAVEN_PROD_ONLY` | `maven.prod-only` | Only scan production dependencies. | | `SEAL_MAVEN_CACHE_PATH` | `maven.cache-path` | Custom local Maven cache folder. | | `SEAL_MAVEN_RENAME_IN_POM` | `maven.rename-in-pom` | Rename sealed packages in POM files. The Maven-only form of `rename-in-manifest`; both settings do the same thing for Maven. | | `SEAL_MAVEN_COPY_ENTIRE_M2_CACHE` | `maven.copy-entire-m2-cache` | Copy the entire `.m2` cache instead of only the project's dependencies. | | `SEAL_MAVEN_SKIP_DIRECTORY_CHANGES` | `maven.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_MAVEN_UPDATE_CLASS_METADATA` | `maven.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Gradle | Variable | YAML key | Meaning | | ------------------------------------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SEAL_GRADLE_PROD_ONLY` | `gradle.prod-only` | Only scan production dependencies (the `runtimeClasspath` configuration). By default the CLI also scans `compileClasspath` and `testRuntimeClasspath`, so compile-only and test dependencies are included. | | `SEAL_GRADLE_HOME_PATH` | `gradle.home-path` | Custom Gradle home for a private cache (must be absolute). | | `SEAL_GRADLE_COPY_ENTIRE_CACHE` | `gradle.copy-entire-cache` | Link the entire Gradle cache instead of only the project's dependencies. | | `SEAL_GRADLE_SKIP_DIRECTORY_CHANGES` | `gradle.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_GRADLE_UPDATE_CLASS_METADATA` | `gradle.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Java files | Variable | YAML key | Meaning | | ---------------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `SEAL_JAVA_FILES_SKIP_DIRECTORY_CHANGES` | `java-files.skip-directory-changes` | Skip adding `.seal` markers in JAR directories. | | `SEAL_JAVA_FILES_UPDATE_CLASS_METADATA` | `java-files.update-class-metadata` | Avoid false positives from scanners that fingerprint class files inside the JAR. Requires `use-sealed-names`. | ### Python | Variable | YAML key | Meaning | | ------------------------------------- | -------------------------------- | ------------------------------------------------------------- | | `SEAL_PYTHON_ONLY_BINARY` | `python.only-binary` | Only install `.whl` artifacts, no source. | | `SEAL_PYTHON_DELETE_FROM_WHEEL_CACHE` | `python.delete-from-wheel-cache` | Delete vulnerable wheels from the global pip cache after fix. | ### Composer (PHP) | Variable | YAML key | Meaning | | ---------------------------- | -------------------- | ---------------------------------- | | `SEAL_PHPCOMPOSER_PROD_ONLY` | `composer.prod-only` | Only scan production dependencies. | ### Bundler (Ruby) | Variable | YAML key | Meaning | | ------------------------ | ------------------- | ---------------------------------- | | `SEAL_BUNDLER_PROD_ONLY` | `bundler.prod-only` | Only scan production dependencies. | ### RPM | Variable | YAML key | Meaning | | ------------------------- | -------------------- | ----------------------------------------------- | | `SEAL_RPM_NO_GPG_INSTALL` | `rpm.no-gpg-install` | Skip GPG signature verification during install. | ### Go | Variable | YAML key | Meaning | | -------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `SEAL_GOLANG_DONT_CHANGE_GO_MOD` | `golang.dont-change-go-mod` | Keep `go.mod`, `vendor/`, and `modules.txt` unchanged. The vendor folder is sealed; manifests retain origin versions. | ## Scanner integrations ### Snyk | Variable | YAML key | Default | Meaning | | ---------------------- | ------------------ | --------------------- | ------------------------------------------- | | `SEAL_SNYK_URL` | `snyk.url` | `https://api.snyk.io` | Snyk API URL. | | `SEAL_SNYK_TOKEN` | `snyk.token` | none | Snyk service-account token. | | `SEAL_SNYK_ORG_ID` | `snyk.org-id` | none | Snyk organization ID. | | `SEAL_SNYK_PROJECT_ID` | `snyk.project-ids` | none | Snyk project ID, or a comma-separated list. | ### Black Duck | Variable | YAML key | Meaning | | ------------------------------------- | -------------------------------- | -------------------------------- | | `SEAL_BLACKDUCK_URL` | `blackduck.url` | Black Duck server URL. | | `SEAL_BLACKDUCK_TOKEN` | `blackduck.token` | Black Duck access token. | | `SEAL_BLACKDUCK_PROJECT` | `blackduck.project-name` | Black Duck project name. | | `SEAL_BLACKDUCK_PROJECT_VERSION_NAME` | `blackduck.project-version-name` | Black Duck project-version name. | ### GHAS (Dependabot) | Variable | YAML key | Default | Meaning | | ----------------------- | ------------------ | ------------------------ | --------------------------------------- | | `SEAL_DEPENDABOT_URL` | `dependabot.url` | `https://api.github.com` | Dependabot endpoint URL. | | `SEAL_DEPENDABOT_TOKEN` | `dependabot.token` | none | GitHub PAT with `repo:security_events`. | | `SEAL_DEPENDABOT_OWNER` | `dependabot.owner` | none | GitHub organization name. | | `SEAL_DEPENDABOT_REPO` | `dependabot.repo` | none | Repository name. | ### Ox Security | Variable | YAML key | Meaning | | ------------------------------------------ | ------------------------------------- | ------------------------------------------------------------------------------- | | `SEAL_OX_URL` | `ox.url` | Ox API URL. | | `SEAL_OX_TOKEN` | `ox.token` | Ox access token. | | `SEAL_OX_APPLICATION` | `ox.application` | Ox application name. | | `SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED` | `ox.exclude-when-high-critical-fixed` | Close the alert when every high- and critical-severity vulnerability is sealed. | ### Checkmarx | Variable | YAML key | Meaning | | ------------------------------ | ------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | `SEAL_CHECKMARX_URL` | `checkmarx.url` | Checkmarx tenant URL. | | `SEAL_CHECKMARX_TOKEN` | `checkmarx.token` | Checkmarx One API key. Mutually exclusive with the OAuth client settings. | | `SEAL_CHECKMARX_CLIENT_ID` | `checkmarx.client-id` | Checkmarx OAuth client ID. Alternative to the API key. | | `SEAL_CHECKMARX_CLIENT_SECRET` | `checkmarx.client-secret` | Checkmarx OAuth client secret. | | `SEAL_CHECKMARX_TENANT` | `checkmarx.tenant` | Checkmarx tenant name. Required with the OAuth client; not used with the API key. | | `SEAL_CHECKMARX_PROJECT_ID` | `checkmarx.project-id` | Checkmarx project ID. | | `SEAL_CHECKMARX_STATE` | `checkmarx.state` | State applied to sealed vulnerabilities: a predefined Checkmarx state or a custom state name. Defaults to `NotExploitable`. | ### SentinelOne | Variable | YAML key | Meaning | | ----------------------------- | ------------------------ | --------------------------------------------- | | `SEAL_SENTINELONE_URL` | `sentinelone.url` | SentinelOne tenant URL. | | `SEAL_SENTINELONE_TOKEN` | `sentinelone.token` | SentinelOne API token. | | `SEAL_SENTINELONE_SCOPE_TYPE` | `sentinelone.scope-type` | Scope type (for example, `site`, `account`). | | `SEAL_SENTINELONE_SCOPE_IDS` | `sentinelone.scope-ids` | Comma-separated scope IDs. | | `SEAL_SENTINELONE_TAG` | `sentinelone.tag` | Tag identifying the scanner policy to update. | ## Custom artifact server Redirects sealed package downloads to a registry you control. Mutually exclusive with the JFrog Artifactory settings below. See [Pulling sealed packages through your own registry](/setup-apps-os/cli-in-cicd/custom-artifact-server.md). | Variable | YAML key | Default | Meaning | | ------------------------------------------- | -------------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SEAL_ARTIFACT_SERVER_BASE_URL` | `artifact-server-base-url` | none | Base URL sealed packages are downloaded from, for every ecosystem. Must be an absolute `http` or `https` URL. Traffic to `cli.sealsecurity.io` and `authorization.sealsecurity.io` is unaffected, and the setting is not applied by `seal image fix`. | | `SEAL_ARTIFACT_SERVER_AUTHORIZATION_HEADER` | `artifact-server-authorization-header` | none | Sent verbatim as the `Authorization` header to that server. Ignored when no base URL is set. Your Seal token is never sent to a configured artifact server. | ## JFrog Artifactory Routes the CLI's Seal traffic through your Artifactory instance: both the calls to the Seal Platform's CLI backend and the sealed-package downloads. Use it when the pipeline's only route out is through Artifactory. Mutually exclusive with the custom artifact server settings above. The Artifactory-side setup is in [Artifactory integrations](/integrations/artifactory.md). The CLI authenticates to Artifactory with a JFrog token, so the build does not need a Seal token. It still needs `SEAL_PROJECT`, which is what attributes the run to a Seal Project. The Seal token is configured once on the Artifactory remotes themselves. Sealed-package downloads through Artifactory cover Java: Maven, Gradle, and Java files. Running the CLI against another ecosystem with `jfrog.enabled` set fails at startup rather than falling back to a direct download. `seal image fix` uses only the CLI-backend remote, so the ecosystem restriction does not apply to it. | Variable | YAML key | Default | Meaning | | -------------------------- | ------------------ | ---------- | ----------------------------------------------------------------------------------------------------------------------------- | | `SEAL_JFROG_ENABLED` | `jfrog.enabled` | `false` | Route the CLI's traffic through Artifactory. A host and a token are both required when this is set. | | `SEAL_JFROG_AUTH_TOKEN` | `jfrog.token` | none | JFrog reference token, sent as a bearer token on every request. | | `SEAL_JFROG_INSTANCE_HOST` | `jfrog.host` | none | Artifactory host, without a scheme (for example, `domain.jfrog.io`). A value that includes `https://` is rejected at startup. | | `SEAL_JFROG_CLI_REPO` | `jfrog.cli-repo` | `seal-cli` | Repository key of the generic remote that fronts the Seal Platform's CLI backend. | | `SEAL_JFROG_MAVEN_REPO` | `jfrog.maven-repo` | `seal-mvn` | Repository key of the Maven remote that fronts the Seal Artifact Server. | Requests to Artifactory are sent over HTTPS. ### Xray ignore rules A separate integration that happens to share the `jfrog` settings block. After a fix, the CLI replaces the Xray ignore rules covering the packages it sealed. It runs only when both settings below are set, alongside `jfrog.host` and `jfrog.token`, and it does not require `jfrog.enabled`. | Variable | YAML key | Default | Meaning | | ------------------------- | -------------------- | ------- | ------------------------------------------------------------------------------------------------------ | | `SEAL_JFROG_XRAY_ENABLED` | `jfrog.xray-enabled` | `false` | Update Xray ignore rules after a fix. | | `SEAL_JFROG_REPOSITORY` | `jfrog.repository` | none | The Xray repository the rules apply to. For a container repository, give it as `/`. | ## Related * [Commands](/reference/cli/commands.md), [Global flags](/reference/cli/global-flags.md) * [Internal scanner integrations](/integrations/internal-scanners.md) * [Artifactory integrations](/integrations/artifactory.md)