There are definitely cases where comments are required to describe intent...the &quot;Why?&quot; of the code.<p>But the problem with comments is that they&#x27;ll inevitably get out of sync with the code.  And a wrong comment is far worse than no comment at all.<p>In a case like Colin&#x27;s, I think something as simple as including &quot;secure&quot; or &quot;secret&quot; in the name of the variable would prevent this stuff from happening.  If your variable is named `secureAccountCode` then it&#x27;s unlikely you&#x27;ll be silly enough to render it back to a hidden input (unless you&#x27;re writing code comments for &quot;Drunk Me&quot; like the Disqus commenter on the article, in which case all bets are off).<p>There&#x27;s a classic Joel on Software article about this, &quot;Making Wrong Code Look Wrong&quot; [1]<p>[1] <a href="http:&#x2F;&#x2F;www.joelonsoftware.com&#x2F;articles&#x2F;Wrong.html" rel="nofollow">http:&#x2F;&#x2F;www.joelonsoftware.com&#x2F;articles&#x2F;Wrong.html</a>