What happens if vulnerabilities are found?

You get a window to fix them, and you may need a retest before the certificate is issued.