use imported urlencode
Move MAC secret into vulnState