Chapter 1
Prepare the right target
- 01
Open the final deployment
Open the same URL a customer would use. Prefer the canonical production host instead of a temporary preview or branch deployment.
- 02
Check the redirect destination
If the URL redirects, confirm that it ends on the expected host. Vybentis shows the normalized target before the scan begins.
- 03
Keep the input public
Do not paste passwords, private preview tokens, signed links or customer specific paths. The first scan observes only public behavior.
Check before continuing
- The final public URL opens without a login
- The hostname belongs to the intended product
- No credentials or customer data are included
Chapter 2
Run the public scan
- 01
Enter the URL
Paste the canonical URL into the scan field. Include https so the intended transport boundary is explicit.
- 02
Confirm the target
Review the normalized hostname and confirm that you own the target or have permission to scan it. Stop if either detail is wrong.
- 03
Start and wait for completion
Start the scan and keep the result page open. The interface shows whether the target is queued, running, completed or stopped with a specific reason.
Check before continuing
- The normalized host matches your application
- The authorization confirmation is accurate
- The report reaches a completed or clearly explained state
Chapter 3
Read the evidence report
- 01
Confirm scope first
Check the normalized URL, scan time and public scan mode. If they do not describe the release you are reviewing, do not use the report for a launch decision.
- 02
Read the release gate
Review blockers, warnings and unknown coverage in that order. Unknown means the scan did not have enough evidence to support a conclusion.
- 03
Open the first blocker
Read the rule identifier, severity, confidence, observed evidence, impact and next action together. Keep the finding open if any of those details remain unclear.
Check before continuing
- Target, time and scope are correct
- Blockers are reviewed before warnings
- Unknown coverage remains visible
Chapter 4
Fix one finding and verify it
- 01
Prepare a scoped fix
Use the finding specific fix prompt or describe the same rule and evidence to your coding agent. Do not combine unrelated findings into one broad rewrite.
- 02
Review and deploy
Inspect the generated change, test the affected behavior and deploy it to the same target that produced the finding.
- 03
Run the matching verifier
Request verification from the finding or run another scan against the same target. Resolved means only that this rule now meets its evidence threshold.
Check before continuing
- Only one scoped issue changes at a time
- Generated code is reviewed before deployment
- Fresh evidence confirms the final state