Fix your first vulnerability

​

Prerequisites

• A Cysmiq account with permission to create or manage a workspace
• Owner access to a supported VCS organization, group, or workspace
• Permission to push a code change to the repository you connect

​

Steps

1

Create a workspace and connect your code

Create or open a workspace, then connect the VCS that contains the repository you want to scan.Follow Quickstart if you still need an account or workspace. See Connect a VCS for provider-specific permissions and connection steps.

2

Wait for the first scan to finish

Cysmiq discovers repositories and queues scans after the connection is active. Open Scans and wait for the repository scan to reach Completed.

The highlighted red count shows the actionable vulnerabilities first seen in this scan. Select it to open the findings.A completed scan can contain findings even when the provider check or pull request result passes. See Scan status and result for the distinction.

3

Open an actionable finding

Select the vulnerability count from the scan, or open Vulnerabilities and select the finding. Start with an actionable item whose evidence and fixing advice you can review with the repository owner.

4

Understand the analysis

Review the Overview first, then open Analysis when it is available. Use the call hierarchy, analysis notes, exploitability reasoning, fixing advice, complexity, and confidence to understand why the finding matters and what a suitable fix should accomplish.

Mention @Shift in the finding chat to ask questions about the evidence or remediation in any language. Explain this further and Generate a fix are prompt templates that add a context-specific request to the chat input. You can edit the prompt before sending it. See Ask Shift for the complete conversation and fix-review workflow.

5

Take ownership of the work

Assign the finding to the person responsible for remediation and move it to In Progress. Add a short comment that records the intended next step.

See Triage vulnerabilities for other workflow outcomes and resolutions.

6

Apply and push the fix

Update the code or configuration according to the fixing advice, review the change, and push it to the monitored branch. Cysmiq queues a follow-up scan for the new revision.

The highlighted green count shows the vulnerability fixed by this scan.

7

Verify the remediation

Return to the finding and confirm that Cysmiq marked it Resolved with the Fixed resolution. Review Activity when you need the recorded assignment, status, and scan-driven resolution history.

8

Invite a teammate

Invite the developers or security reviewers who will share ownership of future findings, then confirm the invitation appears under Invitations.

See Invite your team for role selection, resending, and cancellation.

​

Next steps

• Use saved filters to create focused review queues
• Ask Shift to investigate a finding and review a proposed remediation
• Create tickets to coordinate remediation in Jira or Linear
• Vulnerability lifecycle for all statuses and resolutions