core app is functional, still insecure