Add in the notes from @jvennix-r7  here about how the vulnerable app needs to trigger a controller function.