Your scanner's blind spot for self-hosted apps is policy, not accident — and neither ecosystem coverage nor import lag explains it away

Описание и применение

Сканеры уязвимостей не показывают предупреждения о безопасности для самодеплоименных приложений, если эти предупреждения не привязаны к пакету в индексируемом реестре. Исследование выявило, что около трети таких предупреждений остаются невидимыми, а наличие релиза в поддерживаемом реестре значительно повышает их видимость.

Задача

Self-hosted applications often miss vulnerability advisories in dependency scanners because the advisories are not linked to a package in an indexed registry, making them invisible to scanners.

Результат

About 31.6% of self-hosted app advisories never reach scanners; visibility is 53 points higher for applications than libraries; registry presence increases visibility by 51–58 points; older advisories are more visible but the gap persists.

Рабочий процесс

• Run a pre-registered study to measure advisory visibility
• Identify whether advisories reference a package in an indexed registry
• Check advisory visibility via OSV API (e.g., curl https://api.osv.dev/v1/vulns/<GHSA-id>)
• If advisory lacks a package, name a real package in a supported ecosystem
• For Go apps, use the go.mod module path
• For Docker-only, non-Go apps, communicate limitations to users and file an issue with GitHub

Доказательства

If nothing ties the advisory to a package on an indexed registry, there is nothing for the scanner to match, and the advisory is invisible to it no matter how severe.

Источник

A first census of self-hosted AI/ML tools' own advisories found about a third (31.6%) never reach the global GitHub Advisory Database that scanners read

Источник

The single best predictor of whether an app's advisories reach scanners is whether the app ships a release on an OSV-indexed registry

Источник