Your scanner's blind spot for self-hosted apps is policy, not accident — and neither ecosystem coverage nor import lag explains it away

Description and use

Vulnerability scanners miss self-hosted app advisories when they lack a package link in an indexed registry. About a third of advisories are invisible; registry presence boosts visibility by 51–58 points.

Problem

Self-hosted applications often miss vulnerability advisories in dependency scanners because the advisories are not linked to a package in an indexed registry, making them invisible to scanners.

Outcome

About 31.6% of self-hosted app advisories never reach scanners; visibility is 53 points higher for applications than libraries; registry presence increases visibility by 51–58 points; older advisories are more visible but the gap persists.

Workflow

• Run a pre-registered study to measure advisory visibility
• Identify whether advisories reference a package in an indexed registry
• Check advisory visibility via OSV API (e.g., curl https://api.osv.dev/v1/vulns/<GHSA-id>)
• If advisory lacks a package, name a real package in a supported ecosystem
• For Go apps, use the go.mod module path
• For Docker-only, non-Go apps, communicate limitations to users and file an issue with GitHub

Evidence

If nothing ties the advisory to a package on an indexed registry, there is nothing for the scanner to match, and the advisory is invisible to it no matter how severe.

Source

A first census of self-hosted AI/ML tools' own advisories found about a third (31.6%) never reach the global GitHub Advisory Database that scanners read

Source

The single best predictor of whether an app's advisories reach scanners is whether the app ships a release on an OSV-indexed registry

Source