What are source maps, and are public source maps a risk?
Source maps are .map files that map minified JavaScript back to its original source. Served publicly in production, they expose your full front-end code.
A source map is a .map file that connects minified, bundled JavaScript back to the original source files, so developer tools can show readable code and useful stack traces.
A bundle references its map with a comment at the end:
//# sourceMappingURL=main.4f2a.js.map
Why public source maps are a risk
If the map is publicly served, anyone can rebuild your original front-end source code, including comments, internal API routes, feature flags and any values that were hard-coded. It is not a vulnerability by itself, but it makes every other mistake easier to find.
What to do
Disable production source maps, or upload them privately to your error-tracking service instead of deploying them alongside your JavaScript.
Related
- Exposed .env and .git file checker
Free tool that checks if your site publicly serves .env, .git, wp-config backups, SQL dumps or source maps, and verifies content to avoid false positives.
- Leaked API key checker
Free tool that scans your site's JavaScript for leaked API keys from OpenAI, Stripe, AWS, Supabase and more. Masked, never stored in full.
- What is cloaking in SEO?
Cloaking means showing search engines different content or redirects from what human visitors see. It is a spam technique and a common sign of a hacked website.