How Are Vulnerabilities Found and Fixed?

Hi everyone, I'm new here,

I've read many of master OTW's posts relating to cyber security and hacking. And have only recently (as in today) decided to get an account at WonderHowTo's website to ask questions and learn here.

To my main question,

I've seen in many of OTW's tutorial posts about finding exploits/vulnerabilities from searching metasploit. But I've always wanted to know how the exploits/vulnerabilities were found in the first place, and how are they fixed when found.

Can someone answer my question?

thank you