How do you approach tracking remediation status for vulnerabilities identified during scans?