Vulnerability Overview
Sensitive data was split across developer comments in two external files — a CSS stylesheet and a JavaScript file — linked from the main page. The split across files added a minor discovery step but no meaningful security barrier.
Exploitation
Viewing page source revealed two external resources: style.css and script.js. Opening each file directly in the browser:
/* style.css */
/* picoCTF{1nclu51v17y_1of2_ */
// script.js
// f7w_2of2_6edef411}Concatenating both halves in order produced the complete flag.
Key Insight: Always enumerate all linked resources — CSS, JavaScript, fonts, images, and third-party includes. Secrets split across files are still discoverable; the split adds at most one additional step. Comments in CSS and JavaScript carry the same visibility as HTML comments — they are part of the public response body.