you can disable CSS as well, although it requires some work to keep it disabled in Firefox. It makes sites look pretty ugly though. But I can use SR without fonts, javascript, images or CSS. And I think that should protect from at least a huge amount of potential exploits. Not sure what else to disable after that .