Rust has 1,332 vulnerability advisories for every open-source scanner. Dart has zero scanners.

We keep hearing that dependency scanning is a solved problem — pick a tool, wire it into CI, done. That's true if you write JavaScript or Python. If you write Rust, Dart, or Elixir, the map has holes you can measure.

We counted the vulnerability advisories in each package ecosystem (from OSV.dev) against the number of open-source tools that can actually scan it (from the analysis-tools.dev catalog). The mismatch is not subtle.

TL;DR

Across 11 ecosystems: 47,422 vulnerability advisories, and only 42 open-source security tools to cover all of them.

Rust has 1,332 advisories per open-source scanner (2,663 advisories, 2 tools). Python's ratio is 999:1, PHP 979:1, Go 715:1.