Pre-registered result - your scanner misses half of self-hosted apps' own security advisories

说明与用途

依赖扫描器经常忽略自托管应用程序发布的自身漏洞，导致漏洞检测中的盲点。

问题

Dependency scanners often miss security advisories published by self-hosted applications, leading to blind spots in vulnerability detection.

结果

Self-hosted applications have a significantly higher rate of scanner‑blind advisories (53.0%) compared to libraries (0%).

工作流

• Select 40 top self-hosted applications and 40 top libraries; ensure no overlap with previous samples.
• Identify published repository advisories at least 14 days old.
• Determine scanner‑blind advisories: those with no OSV record naming a package, searched by GHSA ID and CVE aliases.
• Perform a two‑sided permutation test (10,000 permutations, fixed seed) to compare blind rates between groups.
• Report results and confidence intervals.
• Spot‑check individual advisories (e.g., Vaultwarden GHSA-h6cc-rc6q-23j4).

证据

The split holds.

来源

Applications minus libraries is +53.0 points, p = 0.0057.

来源

If you self-host something, don't expect your dependency scanner to warn you about that application's own advisories.

来源