Exposed source maps: your original code, one click away

What it is

When a build tool generates a .map file, it adds a comment like //# sourceMappingURL=index-a1b2.js.map at the end of the bundle. Browsers fetch that file when developer tools are open and show the original files, folder structure, variable names and comments. Many templates turn source maps on during development, and an AI tool debugging a production error may turn them on for the production build and never turn them off.

What can happen

On its own, a public source map is not a breach: your frontend code runs in the browser anyway. But the map makes it far easier to read. It shows internal API routes, admin screens hidden behind a flag, validation that only happens on the client, and comments such as “TODO: check permissions”. It also often contains values that were stripped from the minified file, including keys that someone thought were only in development code.

How Shypset checks it

This is a Public check. We look at up to 15 scripts your page loads, read the sourceMappingURL comment of each, and request only the map files the scripts themselves point to, as a browser would. We report how many maps are reachable and list their URLs. Without secrets inside, the finding is low severity, because the map only shows code the browser already runs. If any map contains something that matches our secret patterns, it becomes high, because the leak is then not only code but credentials.

How to fix it

• Vite: set build.sourcemap: false, or "hidden" if you upload maps to an error tracker. Hidden maps are generated but not referenced from the bundle.
• Next.js: keep productionBrowserSourceMaps off, which is the default.
• Make sure your deploy step does not upload .map files, or block them at the host.
• If a secret was ever visible in a map, rotate it.

Then redeploy and rescan. The map URLs should now return 404 and the finding disappears.

Example finding

The finding as it appears in a report, with its fix prompt.

Exposed maps: https://app.example.com/assets/index-a1b2c3.js.map, https://app.example.com/assets/vendor-d4e5f6.js.map

Production serves JavaScript source maps. Change the build config so production builds do not publish source maps (Vite: build.sourcemap false or "hidden"; Next.js: productionBrowserSourceMaps false), make sure the deploy does not include .map files, and tell me if any secret appears in the current source so I can rotate it.

Questions

Do I lose error tracking without source maps?

No. Use hidden source maps and upload them to your error tracker during the build; they stay private.

Why only 15 scripts?

It keeps the scan fast and light on your site. Most apps load far fewer scripts than that.