HTML comments need an information-exposure review
If this finding appears in a report, sampled HTML comments matched an information-exposure pattern. Comments are readable in the delivered source even when hidden from the rendered page. A TODO, internal-looking name or development URL is not automatically a secret. This reference page does not inspect your source or establish a compromise.
Why this matters
An actual credential, private configuration value or useful internal detail in public HTML can create risk. Other comments may be harmless or required by the framework, template or licence. The impact depends on the exact exposed information and whether it remains valid; a pattern match alone cannot determine severity.
How to fix it
Review the matched comment in the actual delivered response and classify the information without copying secrets into tickets or public tools. Remove unnecessary sensitive material at its source. If a live credential was exposed, have the authorised owner revoke or rotate it and investigate its use; removing the comment alone is insufficient. Review other public outputs that may contain the same value. Preserve required framework and licence comments rather than stripping every comment indiscriminately, then rebuild and test the affected pages. Confirm the deployed response no longer exposes the specific information and record the remediation without retaining the secret.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit