View-source on the housing-application site shows HTML comments that still name a staging hostname. What should the PORP-style researcher do?
Select an answer to reveal the explanation.
Short Explanation
HTML comments are like sticky notes left on the shop window — anyone walking by can read them. Staging hostnames in public source are collectible artifacts. Write them down; do not treat staging as a box to break into.
Full Explanation
When view-source on the housing-application site shows HTML comments that still name a staging hostname, the PORP-style researcher should capture the public comment and staging name as a website artifact without attacking the staging host. HTML comments in production are shop-window sticky notes anyone can read. Logging into the staging host with guessed civic passwords to prove the environment is live fails as unauthorized access testing. Deleting the comments by exploiting a CMS plugin on the production housing site fails as offensive remediation outside OSINT. Ignoring HTML comments because only rendered page text counts as website OSINT fails; source comments are classic public artifacts. Exam caveat: a named staging host is a lead about environment layout, not a license to probe it. Operational check: save page source excerpt with URL and date; report the staging hostname to housing IT as an information-exposure finding; do not authenticate to staging. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate the finding against current public sources before the next procurement or communications decision.