Security Test: Sensitive Comments¶

Description¶

Default Severity: low

Sensitive comments are pieces of code documentation that unintentionally reveal details about the application's inner workings. This is dangerous because, if attackers access your source code—even just the comments—they can learn about potential security weaknesses and design flaws that could be exploited. Many developers might leave personal notes or debugging information in the code, not realizing that these details can be gathered by anyone who gets access to the repository, ultimately making the application more vulnerable to targeted attacks.

Configuration¶

Identifier: information_disclosure/sensitive_comments

Examples¶

All configuration available:

checks:
  information_disclosure/sensitive_comments:
    skip: false # default

Compliance and Standards¶