That's all very nice, but it seems to do more with the fact that each person gets his/her own subdomain. And given that I found three xss's in about five minutes [edit: and then like ten more in the next five seconds, after realizing any input box works] doesn't give me confidence in their abilities.

http://www.pinkbike.com/news/search/?q=%3C%2Ftitle%3E%3Cscri...

http://www.pinkbike.com/product/compare/?items=466,%22%3E%3C...

http://www.pinkbike.com/photo/list/?date=all&text=%3C/ti...

http://www.pinkbike.com/buysell/list/?q=%3Cscript%3Ealert%28...

http://www.pinkbike.com/forum/search/?q=%3C/title%3E%3Cscrip...

Edit: I've stopped adding xss's. It's actually harder to find input boxes which don't lead to xss's than ones which do.