The one thing that predicts whether your self-hosted app's own advisories reach your scanner

Description and use

Apps that publish official packages to a public registry and reference them in advisories are about four times more likely to be seen by OSV-backed scanners than Docker-only or binary-only apps.

Problem

Self-hosted applications often have security advisories that are invisible to OSV-backed scanners because the advisories do not reference a package in a public registry.

Outcome

Apps that publish an official package to a public registry and name it in their advisories have a significantly lower scanner-blind rate (≈25%) compared to Docker-only or binary-only apps (≈85%).

Workflow

• 1. Classify each repo as "registry" or "no_registry" based on whether it publishes an official, live package containing its own code to a registry OSV indexes.
• 2. Identify published advisories that are at least 14 days old.
• 3. For each advisory, check if any OSV record names a package under its GHSA ID or CVE alias.
• 4. Mark advisories with no matching package as "scanner-blind".
• 5. Calculate blind percentage per group and perform a two-sided permutation test (10,000 permutations).
• 6. Interpret results: a lower blind percentage for "registry" apps indicates the lever works.
• 7. For self-hosted apps that are "no_registry", monitor the Security tab or run blindspot.py to detect blind advisories.
• 8. For "registry" apps, ensure advisories name the affected package to make them scanner-visible.

Evidence

about half of an app's own published security advisories name no package in OSV, so Dependabot, npm audit and pip-audit — which can only match an advisory that names a package — never see them.

Source

apps which also ship their own code to a public package registry OSV indexes (npm, PyPI, Go, …) were mostly visible, while Docker-only / binary-only apps were almost entirely blind.

Source

The median no_registry app has 100% of its own advisories invisible to an OSV-backed scanner; the median registry app has about a quarter.

Source

If you self-host an app distributed only as a Docker image or binary, don't expect your dependency scanner to warn you about that app's own advisories — watch its Security tab, or run blindspot.py --package repo:OWNER/REPO.

Source