https://samarthya.me/tags/osv/Recent content in Osv on SamarthyaHugo -- gohugo.ioen© Samarthya 2018-2026. All rights reserved.Wed, 04 Nov 2026 21:00:00 -0500https://samarthya.me/posts/osv-scanner-on-my-own-blog/Wed, 04 Nov 2026 21:00:00 -0500https://samarthya.me/posts/osv-scanner-on-my-own-blog/<div class="lead text-neutral-500 dark:text-neutral-400 !mb-9 text-xl"> A test project is a controlled experiment; your own repository is the one that talks back. I pointed OSV-Scanner at the source of this blog expecting a dull report. The report was indeed dull. The interesting part was what it could not see. </div> <figure><img class="my-0 rounded-md" loading="lazy" decoding="async" fetchpriority="low" alt="Anime-style illustration: an excited young experimenter in a lab coat, with goggles pushed up on the forehead, holds a glowing green flask high at a lab bench and says &ldquo;Let&rsquo;s try it!&rdquo;" src="https://samarthya.me/posts/osv-scanner-on-my-own-blog/overview.svg" ><figcaption>The mood of the evening. It lasted until the first command.</figcaption></figure> <p>In parts <a href="https://samarthya.me/posts/learning-osv-2-scanning-with-osv-scanner/" >2</a> and <a href="https://samarthya.me/posts/learning-osv-3-guided-remediation/" >3</a> I used a project built to be vulnerable. This time the target is <a href="https://github.com/samarthya/blog.samarthya.me" target="_blank" rel="noreferrer">the repository behind this site</a>: Hugo, the Blowfish theme as a git submodule, some Python helper scripts and two GitHub Actions workflows. All runs used OSV-Scanner v2.7.0.</p>