Network requirements
Domains the Seal Platform reaches over HTTPS.
Last updated
Domains the Seal Platform reaches over HTTPS.
All Seal traffic is outbound HTTPS to seal-owned hostnames. If your environment uses a firewall, egress proxy, or strict network policy, allow-list the hostnames below. There is no inbound traffic from Seal into your environment.
You can also allow-list the parent domain (*.sealsecurity.io) and any AWS CloudFront edges, which is functionally equivalent and easier to maintain. The per-hostname list is provided for environments that require specific entries.
app.sealsecurity.io
The Seal UI.
authorization.sealsecurity.io
Authentication and token validation.
d2zko6i8myndc4.cloudfront.net
UI assets.
d2yf0nsg4eo6kr.cloudfront.net
UI assets.
d1xflzzelmcieu.cloudfront.net
Generated reports.
Hosts that run the Seal CLI (CI runners, build agents, developer machines) additionally need:
cli.sealsecurity.io
CLI configuration, Sealing Rule retrieval, and project initialization.
Anywhere sealed package artifacts are actually fetched (your CI build, a host running seal fix --os, a mirroring proxy) needs reachability to the artifact-server hostnames for the ecosystems you consume. The list is independent of how the pull is invoked.
npm.sealsecurity.io
Node.js (npm, Yarn, pnpm)
pypi.sealsecurity.io
Python (pip, Poetry)
maven.sealsecurity.io
Java (Maven, Gradle)
go.sealsecurity.io
Go modules
packagist.sealsecurity.io
PHP (Composer)
ruby.sealsecurity.io
Ruby (RubyGems, Bundler)
nuget.sealsecurity.io
.NET (NuGet)
rpm.sealsecurity.io
RHEL, CentOS, Fedora, Amazon Linux
deb.sealsecurity.io
Debian, Ubuntu
apk.sealsecurity.io
Alpine Linux
Hosts that pull sealed container images (Seal Base Images, Seal My Container output, Seal Vendor Apps output) need reachability to the Seal-issued registry hostname for your tenant. Your Seal account team provides this hostname; it differs per tenant.
See Authenticating with Seal's image registry.
Last updated