Thanks for the feedback. We will try to make that clearer - it does look for vulnerabilities anywhere it can.

And thanks for the info on the iFrame - I'll look into that as well.