Thanks for sharing that experience, i often wondered whether I'm alone being lead on ad infinitum.

BUT - i wrote a small tool recently where scope and environment was set and i wrote the code myself so just wanted a security check. I followed through with all suggestions just to see if it may end - ...

it does!! After adding XSS, CSRF and fixing all undefined edge cases it was actually happy!

So i'd say yes if you define the scope clearly then it will get you there.