> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/using-platform/working-with-seal-apps.md).

# Working with Seal Apps

Seal Apps remediates vulnerabilities in your application's open-source dependencies. Once setup is done, day-to-day operation is a recurring rhythm: review what Seal has discovered, decide what to seal, let the next CI build pick up the change, and verify that the sealed version was pulled.

The shape of "decide what to seal" and "let the build pick up the change" differs by [deployment method](/setup-apps-os/choosing-deployment-method.md). The rest of this chapter is one page per method:

* [Remote](/using-platform/working-with-seal-apps/remote.md) — decisions live as Sealing Rules in the Seal UI; the CLI in remote mode reads them at build time.
* [Local](/using-platform/working-with-seal-apps/local.md) — decisions live in `.seal-actions.yml` in your repository; the CLI in local mode reads them at build time.
* [Automatic Remediation](/using-platform/working-with-seal-apps/automatic-remediation.md) — no decisions; the CLI in all mode replaces every vulnerable package it can.
* [Artifact Server](/using-platform/working-with-seal-apps/artifact-server.md) — decisions live as version pins in your dependency manifest; the package manager pulls the sealed version directly from the Seal Artifact Server.
* [Manual](/using-platform/working-with-seal-apps/manual.md) — you download sealed artifacts from the Repository page and host or use them yourself; nothing runs in your CI.

A Seal Project's deployment method is set at setup time and rarely changes. A tenant may have multiple Seal Projects with different deployment methods; see the matching subpage for each.

## What this chapter does not cover

* The setup mechanics of each deployment method. Those live under [Choosing your deployment method](/setup-apps-os/choosing-deployment-method.md) and the chapters under it.
* The rule mechanics themselves. The Sealing Rules chapter covers the model, the precedence, and (for remote rules) the UI flows: [Sealing Rules](/using-platform/sealing-rules.md), [Remote Sealing Rules](/using-platform/sealing-rules/remote-rules.md), [Local Sealing Rules](/using-platform/sealing-rules/local-rules.md).
* Per-product day-2 rhythms for the other four Seal products (OS, Base Images, My Container, Vendor Apps). Those are the next chapters in this section.

## Common situations across deployment methods

A handful of situations recur regardless of which deployment method a Seal Project uses; each subpage covers them in its own terms.

* **A new vulnerability is disclosed in a package you already use.** The row appears on the Vulnerable packages tab. If you had a Sealing Rule or a manifest pin sealing the package to an existing iteration, Seal will publish a newer iteration; under Remote / Local / Artifact Server the existing rule or pin keeps you in sync as long as it tracks the safest version.
* **A developer adds a new vulnerable dependency.** The next build's discovery adds the row to the Vulnerable packages tab. You either seal it (Remote / Local / Automatic Remediation) or pin a sealed version in the manifest (Artifact Server) or download it yourself (Manual). The dev's PR does not get a special hint from Seal; the discovery happens after the dependency is in.
* **A CI build fails after a Sealing Rule change.** Distinguish between the substitution failing (the sealed version was not pulled — the Protection page tells you) and the build failing on the new dependency (your CI logs tell you). The Protection page's verification step only confirms the pull, not the build outcome.

## Related

* [Working with the platform](/using-platform/working-with-the-platform.md): the cross-product framing of the same rhythm.
* [Choosing your deployment method](/setup-apps-os/choosing-deployment-method.md): the setup-time decision that determines which subpage applies to a given Seal Project.
* [Sealing Rules](/using-platform/sealing-rules.md): the rule model the Remote and Local subpages depend on.