title: Javascript Comments are security risk?
body: <p>During a recient PCI audit the auditor said that we had major security risks because </p>
  
  <ol>
  <li>It was possible to download static resources from our website such as images css and javascript without prior authentication.</li>
  <li>Our javascript had comments in it.</li>
  </ol>
  
  <p>Personally I think that this is not a security risk at all.  The images css and javascript where not dynamically created and they contained no data on our backend, our customer details and on mechanisms.</p>
  
  <p>The comments within the javascript were just simply explaining what the methods in the javascript file did. Which anyone who reads JS could have found out anyway. </p>
  
  <p>How does that show "<a href="http://www.owasp.org/index.php/Top_10_2007-Information_Leakage_and_Improper_Error_Handling" rel="noreferrer">information leakage</a>"? </p>
  
  <p>Are comments within javascript really a security risk?</p>