> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix your first vulnerability

> Connect a repository, understand the first actionable finding, apply a fix, and verify the result with a follow-up scan.

Use this journey to move from a new workspace to a verified remediation. It links the setup, scanning, triage, and collaboration steps into one complete workflow.

## Prerequisites

* A Cysmiq account with permission to create or manage a workspace
* Owner access to a supported VCS organization, group, or workspace
* Permission to push a code change to the repository you connect

## Steps

<Steps>
  <Step title="Create a workspace and connect your code">
    Create or open a workspace, then connect the VCS that contains the repository you want to scan.

    Follow [Quickstart](/guides/quickstart) if you still need an account or workspace. See [Connect a VCS](/guides/connect-vcs) for provider-specific permissions and connection steps.

    <Frame caption="A GitLab connection ready to discover and scan repositories.">
      <img src="https://mintcdn.com/cysmiq/8CzxqQUdE9pJM3up/images/guides/connect-vcs/gitlab-04-connected.webp?fit=max&auto=format&n=8CzxqQUdE9pJM3up&q=85&s=b15bf0bc309c9630e52e9939470b9617" alt="Integrations page showing a connected GitLab provider." width="2880" height="2160" data-path="images/guides/connect-vcs/gitlab-04-connected.webp" />
    </Frame>
  </Step>

  <Step title="Wait for the first scan to finish">
    Cysmiq discovers repositories and queues scans after the connection is active. Open **Scans** and wait for the repository scan to reach **Completed**.

    <Frame caption="A completed scan for the connected repository.">
      <img src="https://mintcdn.com/cysmiq/mogZZ6__Lz_SOAsn/images/guides/first-value/first-value-01-initial-scan.webp?fit=max&auto=format&n=mogZZ6__Lz_SOAsn&q=85&s=32c65082233393fa7ce5ecd4f4c439bc" alt="Scans page showing a completed scan for the storefront repository." width="2880" height="2160" data-path="images/guides/first-value/first-value-01-initial-scan.webp" />
    </Frame>

    The highlighted red count shows the actionable vulnerabilities first seen in this scan. Select it to open the findings.

    A completed scan can contain findings even when the provider check or pull request result passes. See [Scan status and result](/concepts/scans#status-vs-result) for the distinction.
  </Step>

  <Step title="Open an actionable finding">
    Select the vulnerability count from the scan, or open **Vulnerabilities** and select the finding. Start with an actionable item whose evidence and fixing advice you can review with the repository owner.

    <Frame caption="A Flask debug finding with source evidence and workflow controls.">
      <img src="https://mintcdn.com/cysmiq/lbuvMvb731bVwYg6/images/guides/triage-vulnerabilities/triage-01-review-finding.webp?fit=max&auto=format&n=lbuvMvb731bVwYg6&q=85&s=21f5cad11bb9b40a00a40416967425e9" alt="Flask debug vulnerability detail showing source evidence, severity, exploitability, and fixing advice." width="2880" height="2160" data-path="images/guides/triage-vulnerabilities/triage-01-review-finding.webp" />
    </Frame>
  </Step>

  <Step title="Understand the analysis">
    Review the **Overview** first, then open **Analysis** when it is available. Use the call hierarchy, analysis notes, exploitability reasoning, fixing advice, complexity, and confidence to understand why the finding matters and what a suitable fix should accomplish.

    <Frame caption="Analysis explains why the Flask debug configuration is exploitable and how to address it.">
      <img src="https://mintcdn.com/cysmiq/mogZZ6__Lz_SOAsn/images/guides/first-value/first-value-02-analysis.webp?fit=max&auto=format&n=mogZZ6__Lz_SOAsn&q=85&s=e945911be1d463d18f5f40914c4a0020" alt="Analysis tab showing the call hierarchy, exploitability reasoning, fixing advice, complexity, and confidence for a Flask debug finding." width="2880" height="2160" data-path="images/guides/first-value/first-value-02-analysis.webp" />
    </Frame>

    Mention `@Shift` in the finding chat to ask questions about the evidence or remediation in any language. **Explain this further** and **Generate a fix** are prompt templates that add a context-specific request to the chat input. You can edit the prompt before sending it. See [Ask Shift](/guides/shift) for the complete conversation and fix-review workflow.
  </Step>

  <Step title="Take ownership of the work">
    Assign the finding to the person responsible for remediation and move it to **In Progress**. Add a short comment that records the intended next step.

    <Frame caption="An assigned finding marked In Progress.">
      <img src="https://mintcdn.com/cysmiq/lbuvMvb731bVwYg6/images/guides/triage-vulnerabilities/triage-03-in-progress.webp?fit=max&auto=format&n=lbuvMvb731bVwYg6&q=85&s=464798f6246f36316c1f1a7cba2f9599" alt="Flask debug vulnerability assigned to Maya Chen and marked In Progress." width="2880" height="2160" data-path="images/guides/triage-vulnerabilities/triage-03-in-progress.webp" />
    </Frame>

    See [Triage vulnerabilities](/guides/triage-vulnerabilities) for other workflow outcomes and resolutions.
  </Step>

  <Step title="Apply and push the fix">
    Update the code or configuration according to the fixing advice, review the change, and push it to the monitored branch. Cysmiq queues a follow-up scan for the new revision.

    <Frame caption="The follow-up scan completes after the fix is pushed.">
      <img src="https://mintcdn.com/cysmiq/mogZZ6__Lz_SOAsn/images/guides/first-value/first-value-03-follow-up-scan.webp?fit=max&auto=format&n=mogZZ6__Lz_SOAsn&q=85&s=d082bcf49b8ab0e970ad5e5873fb9a30" alt="Scans page showing a completed follow-up scan after the Flask debug fix." width="2880" height="2160" data-path="images/guides/first-value/first-value-03-follow-up-scan.webp" />
    </Frame>

    The highlighted green count shows the vulnerability fixed by this scan.
  </Step>

  <Step title="Verify the remediation">
    Return to the finding and confirm that Cysmiq marked it **Resolved** with the **Fixed** resolution. Review **Activity** when you need the recorded assignment, status, and scan-driven resolution history.

    <Frame caption="The follow-up scan marks the finding as resolved and fixed.">
      <img src="https://mintcdn.com/cysmiq/mogZZ6__Lz_SOAsn/images/guides/first-value/first-value-04-resolved.webp?fit=max&auto=format&n=mogZZ6__Lz_SOAsn&q=85&s=a49a4f98c03c2fe3cd29b52b90c71cf7" alt="Flask debug vulnerability showing Resolved status and Fixed resolution after the follow-up scan." width="2880" height="2160" data-path="images/guides/first-value/first-value-04-resolved.webp" />
    </Frame>
  </Step>

  <Step title="Invite a teammate">
    Invite the developers or security reviewers who will share ownership of future findings, then confirm the invitation appears under **Invitations**.

    <Frame caption="A pending workspace invitation ready for the new teammate.">
      <img src="https://mintcdn.com/cysmiq/PrKIHyccju0wvRQi/images/guides/invite-team/invite-team-03-invitations.webp?fit=max&auto=format&n=PrKIHyccju0wvRQi&q=85&s=cf5ff8f9deee7cdb15da1351542f16e0" alt="Invitations tab showing a pending Developer invitation." width="2880" height="2160" data-path="images/guides/invite-team/invite-team-03-invitations.webp" />
    </Frame>

    See [Invite your team](/guides/invite-team) for role selection, resending, and cancellation.
  </Step>
</Steps>

## Next steps

* [Use saved filters](/guides/saved-filters) to create focused review queues
* [Ask Shift](/guides/shift) to investigate a finding and review a proposed remediation
* [Create tickets](/guides/create-tickets) to coordinate remediation in Jira or Linear
* [Vulnerability lifecycle](/vulnerability-management/lifecycle) for all statuses and resolutions