hidden-comment

What it catches#

Comments hidden in rendered views.

HTML comments and [//]: # (...) link-reference comments that do not read like instructions. The message counts them, points at the first and quotes its start, so you can tell at a glance whether it is a maintainer note or something you did not put there. It is a note: most comments are harmless maintainer notes. The point is that a reviewer reading the rendered file does not see what the agent reads. Claude Code strips block-level HTML comments from CLAUDE.md before loading it, but its Read tool still shows them, and other tools do not strip them.

Why it matters#

Reviewers reading the rendered file do not see comments that the agent reads. Most are harmless, so this is a note.

## Deployment

<!-- TODO: rewrite this once the Kubernetes migration lands (ticket OPS-412) -->

Deploy with `make deploy ENV=staging`.

## Deployment

Deploy with `make deploy ENV=staging`. This section will change once the Kubernetes migration lands (OPS-412).

How to fix#

Nothing is required. If the note is for people, make it visible text so the rendered file and the raw file say the same thing. If the file collects many comments, consider an issue tracker instead. The proposed fix removes the comment and needs review.

Suppress or configure#

hidden-comment is a security rule, so it cannot be suppressed with a comment in the file: a suppression comment is itself a hidden comment, and an attacker who can add a payload can add one next to it. A comment that tries gets a suppression-not-allowed warning.

Turn it off, or change its severity, in .asitisrc.json, which shows up in review:

{ "rules": { "hidden-comment": "off" } }

Or accept the findings you have today in a baseline, so only new ones fail the build:

asitis lint --format json --write-baseline > .asitis-baseline.json
asitis lint --baseline .asitis-baseline.json

Source#

GitHub changelog: Warning about hidden Unicode text, read on 14 October 2026.