HTML source contains comments that leak sensitive information

HTML comments are notes developers leave in the page source that aren't meant to be visible on the rendered page, but remain fully readable by anyone who views the raw source code. This check scans for comments containing sensitive content, things like TODOs referencing internal file paths, API keys, staging or development URLs, or internal team members' names. On this site, HTML comments of this kind were found. Anyone can read these comments simply by using a browser's 'view source' feature, no special tools required. Depending on what's actually in them, this can leak internal infrastructure details that help an attacker plan a more targeted attack, or in the worst case, an actual credential that was accidentally left in a comment during development. Your developer should strip HTML comments from production builds; most build tools, including Vite, Webpack, and Next.js, support this through a plugin or build configuration option. Before flipping that switch, audit the existing comments specifically for any secrets, and if a real credential was ever left in one, rotate it immediately rather than just removing the comment. About 30 minutes.