A vulnerability ticket needs about six statuses: New, Triaged, In progress, In review, Verified and Closed, plus a separate Accepted risk state with an expiry date. Fewer states hide where work stalls. More states create admin nobody keeps current.
The workflow
| Status | Meaning | Entry rule |
|---|---|---|
| New | Created by automation, nobody has looked | Auto, from a scan |
| Triaged | Confirmed real, owner and due date set | A human or a clear policy |
| In progress | Someone is making the change | Assignee starts |
| In review | Fix pull request is open | PR linked to ticket |
| Verified | A rescan shows the finding gone | Scanner confirms |
| Closed | Done | Auto after verification |
| Accepted risk | Not fixing, with reason and expiry | Approver named |
Why Verified matters
Many teams close a ticket when the pull request merges. Merged is not fixed: the wrong version may have been pinned, a second path may include the same package, or the fix may not have shipped. A Verified step, set by a rescan, makes closure a fact. If the rescan still shows the finding, the ticket moves back to In progress.
Keep Accepted risk separate
Do not use Closed for a risk someone chose to keep. An accepted risk is a decision with an owner, a reason and a review date. It should come back to Triaged when the date passes. See how long a risk acceptance should last.
Transition rules worth enforcing
- Triaged requires an owner and a due date. Block the move if either is empty.
- In review requires a linked pull request.
- Closed requires Verified, unless the status is Accepted risk.
- Accepted risk requires an approver, a reason and an expiry.
These rules also make good audit evidence, because each state has a recorded who and when.
Try it yourself
Open the demo and follow a finding from discovery through to resolution. Match each screen to a status in the table.
Click through it at your own pace, or open it full screen.
Quick check
Should a merged pull request close the ticket?
Better to move it to Verified after a rescan confirms the finding is gone. Merged code may not have shipped or may not have fixed every path.
Can I use Closed for accepted risks?
Use a separate status. An accepted risk needs an owner, a reason and an expiry that brings it back for review.
Safeguard can open fix pull requests (off by default, every category on Manual) and rescan afterwards, and you can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
