#fixed code
                                @Test
    public void builder_config() {
        App app = new App(AppConfig.builder().signingSecret("secret").build());
        assertNotNull(app.config());

        app = app.toBuilder().build();
        assertNotNull(app.config());

        app = app.toOAuthCallbackApp();
        assertNotNull(app.config());

        app = app.toOAuthStartApp();
        assertNotNull(app.config());
    }
#vulnerable code 
                                @Test
    public void builder_config() {
        App app = new App();
        assertNotNull(app.config());

        app = app.toBuilder().build();
        assertNotNull(app.config());

        app = app.toOAuthCallbackApp();
        assertNotNull(app.config());

        app = app.toOAuthStartApp();
        assertNotNull(app.config());
    } 
                            #location 4 
                            #vulnerability type RESOURCE_LEAK