2026-10-24 · Daily security tips

Are your source maps shipping your whole codebase?

Many build tools can emit source maps (.js.map files) next to your production JavaScript. If they are public, anyone can open DevTools and read your original source: file names, comments, internal API routes and sometimes hard-coded values.

Check: open your live site, go to DevTools > Sources, and see whether you can browse your src/ folder. Or open one of your script URLs and add .map to the end. If it downloads, it is public.

Fix: disable public source maps for production builds (for Vite set build.sourcemap to false or "hidden"; Next.js keeps browser source maps off unless productionBrowserSourceMaps is true). If you need them for error tracking, upload them to your error tool privately instead of serving them.

If maps were public, assume your code was readable and check it for secrets.