Sorry, I had neglected to mention the well-documented tag whitelist for XSSExtension; this looks like a great candidate for configurability and extensibility as HTML undergoes revisions.

The java API exposed by the sightly engine is fairly limiting (probably on purpose) but there are definitely going to be use cases to extend or override out-of-box behavior. Some immediate ones come to mind:- sightly XSSFIlter & XSSExtension leverages the XSSAPI#formatHtml which relies on XSSFilter ...