The one thing that predicts whether your self-hosted app's own advisories reach your scanner

Описание и применение

Приложения, публикующие официальные пакеты в публичный реестр и указывающие их в своих уязвимостях, видимы сканерам почти в 4 раза чаще, чем Docker‑или бинарные приложения.

Задача

Self-hosted applications often have security advisories that are invisible to OSV-backed scanners because the advisories do not reference a package in a public registry.

Результат

Apps that publish an official package to a public registry and name it in their advisories have a significantly lower scanner-blind rate (≈25%) compared to Docker-only or binary-only apps (≈85%).

Рабочий процесс

• 1. Classify each repo as "registry" or "no_registry" based on whether it publishes an official, live package containing its own code to a registry OSV indexes.
• 2. Identify published advisories that are at least 14 days old.
• 3. For each advisory, check if any OSV record names a package under its GHSA ID or CVE alias.
• 4. Mark advisories with no matching package as "scanner-blind".
• 5. Calculate blind percentage per group and perform a two-sided permutation test (10,000 permutations).
• 6. Interpret results: a lower blind percentage for "registry" apps indicates the lever works.
• 7. For self-hosted apps that are "no_registry", monitor the Security tab or run blindspot.py to detect blind advisories.
• 8. For "registry" apps, ensure advisories name the affected package to make them scanner-visible.

Доказательства

about half of an app's own published security advisories name no package in OSV, so Dependabot, npm audit and pip-audit — which can only match an advisory that names a package — never see them.

Источник

apps which also ship their own code to a public package registry OSV indexes (npm, PyPI, Go, …) were mostly visible, while Docker-only / binary-only apps were almost entirely blind.

Источник

The median no_registry app has 100% of its own advisories invisible to an OSV-backed scanner; the median registry app has about a quarter.

Источник

If you self-host an app distributed only as a Docker image or binary, don't expect your dependency scanner to warn you about that app's own advisories — watch its Security tab, or run blindspot.py --package repo:OWNER/REPO.

Источник