FWIW SuiteCRM has the exact same "remove XSS" button in the admin panel that Sugar has - doesn't exactly scream "we're confident in our security"