Slow improvement toward our first vulnerable app