hey react called, they want their vulnerabilities back