Insecure pull cleanup

This is a PR to cleanup my PR to upstream fig. I'd like it checked in-house before sending it there.