CodeOne
FlawFix
What is FlawFix?
FlawFix (Vulnerability Management System)
FlawFix is a web vulnerability remediation ticketing system that automatically generates a ticket for each vulnerability when you upload a scan result file from HCL AppScan Standard (a web vulnerability diagnostic solution), and tracks and reports the remediation process from developer assignment → analysis → remediation → rescan verification → closure.
To solve the problem of scan results remaining only as reports without leading to actual remediation, it manages the entire process from vulnerability discovery to closure in a single flow, and provides status views tailored to each audience - project teams, management, and developers.
Product Overview
Core Values
Automatic Ticketing of Scan Results
Uploading AppScan Standard scan results automatically generates a ticket for each vulnerability and automatically classifies it as new, duplicate, or recurring.
Issue Status Workflow
Manages 11 statuses from assignment → analysis → remediation → rescan verification → closure with standard transition rules to prevent arbitrary handling.
Severity-Based SLA Management
Set SLA criteria by severity level for each project, and display remaining days and overdue status in real time.
3 Types of Purpose-Built Reports
Provides reports tailored to the viewer - project inspection status, a multi-project overview for management, and per-developer handling status.
4-Tier Permission System
Separates roles into security administrator, security officer, project manager, and developer, assigning permissions per project.
Search, Filter & Bulk Actions
Global search, saved filters, and multi-select bulk actions maintain operational efficiency even as the number of issues grows.
Product Overview
Process Steps
STEP 1
Vulnerability Detection
Detect vulnerabilities via AppScan and generate the result file
STEP 2
Analysis & Classification
Register the vulnerability file (.scan) based on AppScan results, then analyze and classify vulnerabilities
STEP 3
Vulnerability Ticketing
Create a ticket for each vulnerability, deliver it to the development team and assignee, and register the fix and processing results
STEP 4
Management & Statistics
A real-time dashboard tracking status from creation to resolution, vulnerability management statistics and reports on processing time/results, and vulnerability history management and operation
Product Overview
Expected Benefits
Prevents Neglected Scan Results: Scan results are automatically ticketed so assignment and remediation proceed without omission.
Visualizes Remediation Progress: Check progress by status and severity in real time to identify bottlenecks.
SLA-Based Risk Management: Severity-based SLAs and overdue alerts make priorities clear.
Audit & Compliance Support: Secures evidence through status transition history, exception approval records, and audit logs.
Streamlined Reporting: Audience-tailored reports reduce the burden of repetitive manual report writing.