Fixed, accepted or ticketed: close the loop on every vulnerability finding

Most vulnerability reports end the same way. The scan runs, the PDF goes out, and three months later the same findings are back in the next PDF. Nobody decided to ignore them. Nobody decided anything