← All checks
SecurityTypical severity: Medium

HTML Comment Secret Scanner

Scans HTML comments for forgotten keys, passwords or tokens that anyone viewing the source can read.

What it checks

This scanner searches inside HTML comments for keys, passwords or tokens that were left forgotten there. It detects secrets written in comments that anyone can see by viewing the page source.

Why it matters

HTML comments are not private; they reach the browser as-is and anyone can read them with a couple of clicks. A secret forgotten there is as good as published, and it can grant direct access to sensitive services or data.

How to fix it

Remove any comment containing credentials from the published code, and if a secret was ever exposed, revoke it and generate a new one as soon as possible. Always keep keys in server-side environment variables, never in the HTML the browser sees.

Check it on your site

Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.

Scan my site free

From the blog

Related checks