Your scanner's blind spot for self-hosted apps is policy, not accident — and neither ecosystem coverage nor import lag explains it away

说明与用途

当自托管应用的安全通报未关联到索引仓库中的包时，依赖扫描器无法显示。约三分之一的通报无法被发现，发布到受支持仓库可显著提升可见度。

问题

Self-hosted applications often miss vulnerability advisories in dependency scanners because the advisories are not linked to a package in an indexed registry, making them invisible to scanners.

结果

About 31.6% of self-hosted app advisories never reach scanners; visibility is 53 points higher for applications than libraries; registry presence increases visibility by 51–58 points; older advisories are more visible but the gap persists.

工作流

• Run a pre-registered study to measure advisory visibility
• Identify whether advisories reference a package in an indexed registry
• Check advisory visibility via OSV API (e.g., curl https://api.osv.dev/v1/vulns/<GHSA-id>)
• If advisory lacks a package, name a real package in a supported ecosystem
• For Go apps, use the go.mod module path
• For Docker-only, non-Go apps, communicate limitations to users and file an issue with GitHub

证据

If nothing ties the advisory to a package on an indexed registry, there is nothing for the scanner to match, and the advisory is invisible to it no matter how severe.

来源

A first census of self-hosted AI/ML tools' own advisories found about a third (31.6%) never reach the global GitHub Advisory Database that scanners read

来源

The single best predictor of whether an app's advisories reach scanners is whether the app ships a release on an OSV-indexed registry

来源