Your scanner's blind spot for self-hosted apps is policy, not accident — and neither ecosystem coverage nor import lag explains it away

Description and use

About 31.6% of self‑hosted app advisories never reach scanners; visibility is strongly linked to publishing a release on an OSV‑indexed registry. Naming a real package and, for Go, the module path, increases visibility by 51–58 points. Docker‑only, non‑Go apps remain largely invisible.

Problem

Self‑hosted app maintainers often publish GitHub security advisories that vulnerability scanners never surface because the advisories lack a package mapping to an indexed registry.

Outcome

About 31.6% of self‑hosted app advisories never reach scanners; visibility is strongly linked to publishing a release on an OSV‑indexed registry. Naming a real package and, for Go, the module path, increases visibility by 51–58 points. Docker‑only, non‑Go apps remain largely invisible.

Workflow

• Check existing advisories via OSV API (e.g., curl https://api.osv.dev/v1/vulns/<GHSA-id>); if 404 or no package, scanners cannot report it.
• Name a real package (ecosystem + exact installed name) on every advisory when the app has one.
• For Go apps, name the Go ecosystem and the go.mod module path.
• For Docker‑only, non‑Go apps, inform users that scanners will not surface advisories and file an issue on GitHub to request inclusion of non‑ecosystem advisories.
• Run the two‑minute OSV check to verify visibility.

Evidence

If you run a self-hosted app and trust your vulnerability scanner, here is an uncomfortable fact: when the app's own maintainers publish a GitHub security advisory, your scanner often never shows it to you.

Source

The problem is that dependency scanners (OSV-Scanner and everything built on OSV) match installed packages against advisory records. If nothing ties the advisory to a package on an indexed registry, there is nothing for the scanner to match, and the advisory is invisible to it no matter how severe.

Source

A first census of self-hosted AI/ML tools' own advisories found about a third (31.6%) never reach the global GitHub Advisory Database that scanners read...

Source

The single best predictor of whether an app's advisories reach scanners is whether the app ships a release on an OSV-indexed registry... Apps with such a release are 51–58 points more visible...

Source

GitHub's own documentation says reviewed advisories "are mapped to packages in ecosystems we support" and lists twelve: Composer, Erlang (Hex), GitHub Actions, Go, Maven, npm, NuGet, pip, Pub, RubyGems, Rust and Swift.

Source

For non-Go, Docker-only apps, package-less advisories reached scanners 1 time in 638.

Source

I turned all of this into a short, evidence-tagged checklist.

Source