Sensitive Developer Comments
Security Misconfiguration
Category: Security Misconfiguration
Severity: N/A
Description
It is very common, and even recommended, for programmers to include detailed comments and metadata on their source code. However, comments and metadata included into the HTML code might reveal internal information that should not be available to potential attackers. Comments and metadata review should be done in order to determine if any information is being leaked.
Impact
Sensitive data exposure
Remediation
Delete all the HTML source code comments containing sensitive information that can help the attacker gain more insight about the application. It might be SQL code, usernames and passwords, internal IP addresses, or debugging information.
Reference
Last updated