The one thing that predicts whether your self-hosted app's own advisories reach your scanner

说明与用途

将官方包发布到公共注册表并在漏洞通报中引用它们的应用程序，比仅使用 Docker 或二进制文件的应用程序更容易被 OSV 支持的扫描器检测到。

问题

Self-hosted applications often have security advisories that are invisible to OSV-backed scanners because the advisories do not reference a package in a public registry.

结果

Apps that publish an official package to a public registry and name it in their advisories have a significantly lower scanner-blind rate (≈25%) compared to Docker-only or binary-only apps (≈85%).

工作流

• 1. Classify each repo as "registry" or "no_registry" based on whether it publishes an official, live package containing its own code to a registry OSV indexes.
• 2. Identify published advisories that are at least 14 days old.
• 3. For each advisory, check if any OSV record names a package under its GHSA ID or CVE alias.
• 4. Mark advisories with no matching package as "scanner-blind".
• 5. Calculate blind percentage per group and perform a two-sided permutation test (10,000 permutations).
• 6. Interpret results: a lower blind percentage for "registry" apps indicates the lever works.
• 7. For self-hosted apps that are "no_registry", monitor the Security tab or run blindspot.py to detect blind advisories.
• 8. For "registry" apps, ensure advisories name the affected package to make them scanner-visible.

证据

about half of an app's own published security advisories name no package in OSV, so Dependabot, npm audit and pip-audit — which can only match an advisory that names a package — never see them.

来源

apps which also ship their own code to a public package registry OSV indexes (npm, PyPI, Go, …) were mostly visible, while Docker-only / binary-only apps were almost entirely blind.

来源

The median no_registry app has 100% of its own advisories invisible to an OSV-backed scanner; the median registry app has about a quarter.

来源

If you self-host an app distributed only as a Docker image or binary, don't expect your dependency scanner to warn you about that app's own advisories — watch its Security tab, or run blindspot.py --package repo:OWNER/REPO.

来源