Feature creap and bloadware: completely agree.

At my job I am currently trying to mitigate XSS issues because the web application that is in place uses jquery. It is a security risk by default. Rewriting the entire application would be the only secure solution but it is too costly.

If it was an old fashioned desktop application we would not be in this mess...

Web applications are really hard to get and keep them secure.