This means nothing unless they mention what the vulnerabilities are. We do security scans on our front-end javascript code as well; most of the hits we get are for "log injection". Meaning, we have a console.log somewhere and someone could fake our logs by overriding the output. Wow, such vulnerability!