1. DoS/DDoS attacks require extensive preventative measures, and because malicious traffic often disguises itself as legitimate business, it can be difficult to mitigate. This makes it out of scope - unless a specific flaw is making the service more susceptible to DoS/DDoS attacks.
2. Self-XSS is too limited in its effect and requires too many steps to be considered a serious vulnerability. A user ultimately puts themselves at risk when performing XSS, but not really anyone else.
3. OPTIONS can expose debug information that could help attackers, but by itself, is not a vulnerability.
4. SSL vulnerabilities like BEAST require too many other compromised points to present an attack scenario.
5. Clickjacking is when an attacker hides a malicious link in a transparent or obscured link under a legitimate, safe, button so that users are tricked into following the black hat URL.

6. Physical...