SEC-015
JavaScript source maps are public
Last reviewed
Public source maps let anyone rebuild your original front-end source, including comments, internal API routes and logic you assumed was hidden. They are not a vulnerability on their own, but they make every other weakness easier to find. Disable production source maps or upload them privately to your error tracker.
In apps built with AI tools
Some starters and build configs ship source maps in production by default, and agents rarely change build settings unless asked.
What it checks
Whether .map files for the site’s own scripts can be downloaded.
Why it matters
Source maps reveal your original source code, comments and internal API routes.
Recommended fix
Disable production browser source maps, or upload them privately to your error tracker instead.
How to verify
Request the .map URL from the evidence and confirm it returns 404.
Example fix prompt
Please fix this production issue in my app.
Issue SEC-015: JavaScript source maps are public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Disable public production source maps (for Next.js set productionBrowserSourceMaps: false; for Vite set build.sourcemap to false or "hidden"). If an error tracker needs them, upload them privately during the build.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request the .map URL from the evidence and confirm it returns 404.Questions
- Will disabling source maps break error tracking?
- No. Upload them to Sentry or a similar tool at build time instead of serving them publicly.