Sensitive information in HTML comments

Scan.now extracts every <!-- ... --> comment from the homepage, ignores Internet Explorer conditional comments and recognisable build banners, and tests the rest against a set of patterns: credential words (password, passwd, secret, api_key, token), developer markers (TODO, FIXME, HACK, XXX), private address ranges and internal hostnames (10.x.x.x, 192.168.x.x, .local, .internal, staging), filesystem paths (/var/www, C:\), SQL fragments, email addresses, and commented-out anchors pointing at admin, backup or old paths. Comments longer than roughly twenty lines are noted as commented-out code. Matches are shown as short excerpts with the pattern that fired. The check is low severity and expects a human to judge the hits; a theme banner containing "TODO" is a false positive, a database password is not.

Everything inside an HTML comment is delivered to every visitor and indexed by anyone who cares to look; only the browser's rendering hides it. The typical damaging cases are mundane: a commented-out link to /admin-old/ that still works, a staging hostname that has weaker protections, a developer's name and email address that become the pretext for a phishing message, or a template where someone pasted a connection string while debugging. Commented-out code shows an attacker how the application is put together and which parameters exist. The OWASP Web Security Testing Guide lists reviewing page content for information leakage as a standard step, and CWE-615 classifies sensitive data in comments as a weakness in its own right. None of this is exploitable alone, which is why it is rated low, but it shortens an attacker's path. The exposed files guide covers the larger cousins of this problem.

Use server-side comment syntax for notes that should never reach the browser; template engines strip these before output:

{# Jinja2 / Django: not rendered #}
{{-- Blade: not rendered --}}
<%# ERB: not rendered %>
{/* JSX: not rendered */}

Strip remaining HTML comments in the build step. html-minifier-terser:

npx html-minifier-terser --remove-comments --collapse-whitespace -o dist/index.html src/index.html

Vite and Next.js production builds remove comments from JSX-rendered output by default; for server-rendered templates, enable the engine's minifier or add a middleware such as express-minify-html. Then search the templates for what should not be there:

grep -rniE '<!--.*(password|secret|api_key|todo|fixme|192\.168|10\.[0-9]+\.)' templates/

Treat any credential found this way as compromised and rotate it. Remove links to retired paths and make sure those paths actually return 404 or require authentication, rather than relying on nobody noticing them.