HTML comments in a server-side page that embed dynamic, server-side values increase the risk of exposing data that should be kept private. The interpolated value is unknown at analysis time and could leak:
Only HTML comments that interpolate server-side values are considered sensitive and therefore flagged, but not static HTML comments.
Remove the comment or rewrite it using a server-side-only comment syntax (for example <%-- … --%> in JSP, <%# …
%> in ERB, @* … *@ in Razor) so that the comment - and any interpolated value - never reaches the client.
<!DOCTYPE html>
<html>
<head>
<title>User profile</title>
</head>
<body>
<h1>Welcome ${user.name}</h1>
<!-- DEBUG: rendered for ${user.email} (id=${user.id}) --> <!-- Sensitive -->
<!-- Auth token in session: <%= session.getAttribute("authToken") %> --> <!-- Sensitive -->
<p>Your session expires soon.</p>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
<title>User profile</title>
</head>
<body>
<h1>Welcome ${user.name}</h1>
<%-- DEBUG: rendered for ${user.email} (id=${user.id}) --%> <%-- Compliant: server-side-only comment, never reaches the browser --%>
<!-- Reminder: keep this section static --> <!-- Compliant: no interpolation -->
<p>Your session expires soon.</p>
</body>
</html>