While reviewing a school district web app, the tester finds HTML comments pointing to forgotten VCS directories and backup archive paths still reachable in scope. How should those artifacts be treated?
Select an answer to reveal the explanation.
Short Explanation
Leaving a backup or source repo hanging off a public site is like leaving the master keys on the porch. Call it out right away under the RoE—do not quietly tidy the server yourself.
Full Explanation
Exposed version-control trees and backup archives can disclose source code, credentials, and configuration. Professional practice is to classify them as high-impact recon findings and escalate per the rules of engagement. Testers should not destroy client data, hide the discovery, or treat comments as irrelevant.