Suggestion

When you connect a new repository from a security tool, the Vulnerability found trigger will be triggered by vulnerabilities that are already closed since it only considers the event of finding a vulnerability.

Workaround

To avoid creating issues linked to the vulnerability, you can disable the rule before connecting new repositories.