Content inside an HTML comment
An HTML comment: read by every extractor that touches the bytes, displayed by nothing.
How the text is hidden
The tag scanner recognises a comment as its own token and captures the text between the delimiters as a run with the reason non-rendered-part. Comments are captured wherever they appear, including inside <head>, and the runs are collected into the document's attribute-text block alongside alt, title and the other never-displayed slots.
Why a model still reads it
A comment is in the source bytes and in the DOM as a comment node. Text extractors that work on the raw markup return it verbatim, and it is an obvious place to park an instruction because no rendering step ever touches it.
What we do about it
The rule fires on the reason non-rendered-part for any HTML document with non-empty comment text, at informational with action flag — reported and retained, never stripped. It is a separate technique from html.attribute-text precisely so a reviewer can tell them apart: filing-agent converters emit a comment per page break, and a report claiming thousands of characters of "attribute text" that turn out to be page markers is noise rather than evidence. containerVisibility is editing-only, because view-source and a text editor both show it and calling it never would tell a caller no human could ever have seen content one keystroke away in a browser.
How often it fires
63.1% of EDGAR EX-10 exhibits — real commercial contracts filed with 8-K reports, measured 2026-08-16.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A crawl of 1.2 billion URLs across 24.8 million hosts found 15,300 validated injections on 11,700 pages, about 70% of them sitting in parts of the HTML a browser never renders — headers, comments and metadata.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API