While reviewing a school district web app, the tester finds HTML comments pointing to forgotten VCS directories and backup archive paths still reachable in scope. How should those artifacts be treated?
Select an answer to reveal the explanation.
Short Explanation
Leaving a backup or source repo hanging off a public site is like leaving the master keys on the porch. Call it out right away under the RoE—do not quietly tidy the server yourself.
Full Explanation
HTML comments pointing to forgotten VCS directories and backup archive paths still reachable on a school-district web app should be treated as critical recon finds and reported immediately per RoE. Comments can be highly security-relevant when they disclose hidden paths. Using those paths only as password-spray wordlists without reporting withholds important risk from the district. Deleting artifacts from the live server before telling the client is unauthorized change. Exam caveat: retrieve only minimal proof files and protect any source code or student data discovered. Operational check: verify the paths respond, capture evidence, stop deep extraction if sensitive content appears, notify the designated contact immediately, and recommend removal of VCS/backup exposure from public web roots. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.