Vulnerability scanners miss 31.6% of self-hosted app advisories

A study by Munim found that about a third of GitHub security advisories for self-hosted apps never reach the GitHub Advisory Database that scanners like OSV-Scanner read. The main cause is GitHub policy: advisories are mapped only to packages in 12 supported ecosystems, leaving Docker-only apps without a registry package invisible.

• 31.6% of self-hosted app advisories never reach scanner databases
• Apps are 53 points more often blind than libraries
• A release on npm/PyPI raises visibility by 51–58 points
• Docker-only non-Go apps' advisories reached scanners 1 time in 638