Vulnerability Overview
The flag was stored in an HTML comment directly in the page source. HTML comments are rendered invisible in the browser viewport but are entirely visible to anyone who views the page source with Ctrl+U.
Exploitation
Viewing the page source revealed the flag at the bottom of the document:
<!--picoCTF{1n5p3t0r_0f_h7ml_8113f7e2}-->
Key Insight: HTML comments are not hidden. They are developer notes that happen to be invisible in the rendered browser view — but every character is transmitted to the client and readable via page source. In real-world applications, HTML comments have exposed API endpoints, internal hostnames, developer credentials, and staging environment URLs. Always strip comments before production deployment.