A junior developer claimed they hid the flag "somewhere nobody will look" on this very page. Sometimes the obvious place IS the hiding place. Download the attachment and view its HTML source carefully.