You actually have a point there based on my dealing with XSS attacks in the past. It's been a while.

Regardless, even if JS is obfuscated, wouldn't it (for the most part) be beside the point with the framework already out in the open and the SDK perhaps only a couple of months away? Part of me thinks that, with this knowledge out there and being actively investigated (to the delight of the developer community), Palm isn't going to run around closing the gates at this point.