a/b testing the insertion of vulnerable code is not a good idea.