HTML Comment Secret Scanner
Scans HTML comments for forgotten keys, passwords or tokens that anyone viewing the source can read.
What it checks
This scanner searches inside HTML comments for keys, passwords or tokens that were left forgotten there. It detects secrets written in comments that anyone can see by viewing the page source.
Why it matters
HTML comments are not private; they reach the browser as-is and anyone can read them with a couple of clicks. A secret forgotten there is as good as published, and it can grant direct access to sensitive services or data.
How to fix it
Remove any comment containing credentials from the published code, and if a secret was ever exposed, revoke it and generate a new one as soon as possible. Always keep keys in server-side environment variables, never in the HTML the browser sees.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free