I ran Scrawlr against Foundstones HacMe Bank web site, which is riddled with SQL Injection vulnerabilities, and it came up with nothing. If the application cannot identify the base level vulnerabilities in a purposefully built vulnerable site, is it not leading others into a false sense of security? Or am I missing something?