HTML comments in a server-side page that embed dynamic, server-side values increase the risk of exposing data that should be kept private. The interpolated value is unknown at analysis time and could leak:

Only HTML comments that interpolate server-side values are considered sensitive and therefore flagged, but not static HTML comments.

Ask Yourself Whether

Recommended Secure Coding Practices

Remove the comment or rewrite it using a server-side-only comment syntax (for example <%-- …​ --%> in JSP, <%# …​ %> in ERB, @* …​ *@ in Razor) so that the comment - and any interpolated value - never reaches the client.

Sensitive Code Example

<!DOCTYPE html>
<html>
<head>
  <title>User profile</title>
</head>
<body>
  <h1>Welcome ${user.name}</h1>

  <!-- DEBUG: rendered for ${user.email} (id=${user.id}) --> <!-- Sensitive -->
  <!-- Auth token in session: <%= session.getAttribute("authToken") %> --> <!-- Sensitive -->

  <p>Your session expires soon.</p>
</body>
</html>

Compliant Solution

<!DOCTYPE html>
<html>
<head>
  <title>User profile</title>
</head>
<body>
  <h1>Welcome ${user.name}</h1>

  <%-- DEBUG: rendered for ${user.email} (id=${user.id}) --%> <%-- Compliant: server-side-only comment, never reaches the browser --%>
  <!-- Reminder: keep this section static --> <!-- Compliant: no interpolation -->

  <p>Your session expires soon.</p>
</body>
</html>

See