I think his concern is- since the security program would need to run on the attacker&#x27;s computer, the attacker may simply opt not to use it, circumvent it. That being said, I don&#x27;t see why it can&#x27;t be used to sanitize requests to the server.