Earlier I showed that self-hosted applications are far more scanner-blind than libraries: about half of an app's own published security advisories name no package in OSV, so Dependabot, npm audit and pip-audit — which can only match an advisory that names a package — never see them. That raised ...
Source: [Dev.to](https://dev.to/munimv2/the-one-thing-that-predicts-whether-your-self-hosted-apps-own-advisories-reach-your-scanner-2f6o)