I agree with you about Sleepy Puppy not being a universal solution - however this is true for almost every tool.<p>The big wins with SP:<p>* automated<p>* narrows what kind of XSS can be present.<p>Security seems to be like quantum mechanics: there is always an uncertainty principle that prevents perfection.