Scanners miss 53% of self-hosted apps' own security advisories

A pre-registered study found that 53% of security advisories from self-hosted applications (909 records across 27 repos) never reach OSV and stay invisible to Dependabot, npm audit and pip-audit, versus 0% for libraries (11 records). The +53 percentage-point gap was significant at p = 0.0057.

• 909 advisories from 27 self-hosted apps: 53.0% scanner-blind (95% CI 49.8–56.3%)
• Libraries: 0% of 11 advisories; gap of +53 points, p = 0.0057
• 81.5% of 14–29-day-old app advisories are blind vs 36.8% of those 90+ days old
• Example: Vaultwarden's GHSA-h6cc-rc6q-23j4 returns 404 on api.osv.dev