Got it.

Ask me about this later (why it wasn't saying things were secure), it's
a subtle bug and has to do with how java implicitly makes constructors.
Updates and limits etc