Leaving comments in HTML source code when an application leaves the development environment
-
Is a good programming practice
-
Is very useful during code reviews
-
Is the recommended practice for secure code maintenance
-
May give the attacker valuable information to perform an exploit
HTML comments in production code can reveal implementation details, debugging information, database structure, or security vulnerabilities to attackers. This is not secure coding practice. Comments should be removed or minimized before deployment.
Comments left in production HTML source can include developer notes, file paths, internal API details, or even leftover credentials. Attackers routinely view page source looking for exactly this kind of leaked information to plan an exploit. Good practice is to strip debugging/dev comments before deploying to production, not treat them as harmless documentation.