2026-11-09 · Daily security tips

Does your minified JavaScript still point at a source map?

Production JS often ends with //# sourceMappingURL=app.js.map, or a full https URL on a CDN. Deleting the .map file later does not rewrite files already on the host. That comment is not always the script path plus .map, so guessing can miss it.

Check: open a JS file from DevTools > Network and read the last line. If you see sourceMappingURL, resolve it against the script URL (or use it as-is if it is absolute) and run curl -sI. A 404 is fine. A 200 means the map is public; search its sourcesContent for keys, tokens and internal routes.

Fix: rebuild with maps off (Vite build.sourcemap false; keep Next.js productionBrowserSourceMaps off), redeploy so the comment is gone, and delete leftover maps from the host or CDN. If you need maps for errors, upload them privately to your error tool.

If a map was public, rotate any key you find.