2026-11-01 · Daily security tips

Are your "hidden" source maps still public?

Turning source maps down in your build is a good move, but check what actually reached production. Vite's "hidden" option, and many error-tracking setups, still write .js.map files next to your scripts. They only drop the comment that points to them, so anyone who guesses the URL can download them.

Check: copy a script URL from DevTools > Network, add .map, and run curl -sI on it. A 404 is good. If it returns 200, the map's sourcesContent field holds your original code, so search it for keys, tokens and internal URLs.

Fix: set build.sourcemap to false in vite.config, keep productionBrowserSourceMaps off in next.config, or upload maps to your error tool and delete them from the build output before deploying.

Found a key in there? Rotate it now.