This article covers what to do once a scan finishes: reading the result, working through findings, deciding what to do with each one, and confirming that fixes actually worked.

1. Check coverage first

Open the scan from Scans. The Overview tab shows severity counts and scan coverage: requests scanned, and URLs discovered in scope. A scan that found little because the app is clean looks the same as one that found little because discovery never reached anything. If only a handful of URLs were discovered on a large app, fix discovery or authentication and rescan.

The other tabs are Findings, Sitemap (what the scanner reached), Scope (the rules applied) and Logs.

2. Read a finding

On the Findings tab, findings are grouped by severity (Critical, High, Medium, Low, Info) and then by type. Select one to see:

• CVSS score and CWE reference
• The exact URL and parameter
• Overview: what it is and why it matters
• HTTP Req/Resp: the request and response side by side, with the injected payload and the matching evidence highlighted
• Steps to Reproduce and Remediation

Always read the evidence, not just the title. It shows you why the scanner raised the finding.

3. Decide

• Mark as False Positive: not exploitable in your context. It moves into its own group and stays out of reports.
• Mark as Fixed: you have remediated it.
• Create Ticket: sends it to Jira, GitHub Issues, Linear, GitLab or Azure DevOps with evidence and remediation attached. Use Select all → Create Tickets for bulk work.

False-positive and fixed states carry over into future scans, so you do not re-triage the same item every week. Triage false positives before filing tickets.

4. Retest the fix

When a developer says an issue is fixed, click Retest. Vooki Pro re-runs the same detector that raised the finding against the live app and returns a verdict with the fresh response attached:

• Still Vulnerable: the detector fired again.
• Fixed: it no longer fires, and Vooki Pro offers to mark the finding fixed.
• Needs Manual Review: the result was ambiguous, so check it by hand.

5. Look across every scan

All Findings in the sidebar shows every scan's findings in one list. Filter by severity, type or originating scan to answer "does this issue appear anywhere else?". Host-wide issues such as a missing header, a cookie flag or weak TLS are consolidated into one finding, not repeated for every URL.

The Vulnerability KB screen is a browsable reference of every finding type: what it means, how to fix it, and which compliance controls it maps to.

Next: Reports and compliance · Full reference: Findings & retest (docs)