Stop 7 of 42 · The Front Door · Exposed source maps

Blueprints left on the front counter

The bank hands visitors a scrambled shorthand copy of its procedures so they load fast. But the architect’s fully annotated blueprints, which unscramble every line, were left on the same counter. Mallory picks up both.

The Front DoorSources checked 25 Oct 2026

Watch it happen

Play it as

The public counter holds scrambled code plus a source map. Mallory uses the map to read the original code.

Arrival

Your app ships a scrambled copy of its code to every visitor (app.min.js). Mallory walks in like any visitor.

1 / 5

In bank terms and app terms

In the bank	In your app
Scrambled shorthand copy	Minified JavaScript bundle sent to browsers
Architect’s annotated blueprint	A `.map` source map file with original names and often full source
Left on the public counter	Map files deployed next to the bundle, reachable by URL
Filed in the back office	Uploading maps privately to an error tracker, or not generating them in production

Are you exposed?

You might be exposed if…

Opening yourapp.com/assets/app.js.map (or any .js.map URL from your page) downloads a file.
Your bundle ends with //# sourceMappingURL=… and your build has productionSourceMap or sourcemap: true turned on.
Front-end code contains API keys, admin route names or comments you wouldn’t want strangers to read.

What to do about it

Turn off public source maps for production: in Next.js leave productionBrowserSourceMaps off, in Vite set build.sourcemap: false, in Create React App set GENERATE_SOURCEMAP=false.
If you need maps for debugging, upload them to your error tracker (such as Sentry) and delete them from the public output folder.
Never put secrets in front-end code, because even without a map, anyone can read what the browser downloads.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt

Check our production build for exposed source maps. Make sure the build does not publish .map files (for example Next.js productionBrowserSourceMaps stays false, Vite build.sourcemap is false; "hidden" still writes .map files, so keep those out of the deployed folder) and that bundles do not end with a sourceMappingURL comment. If we need maps for error tracking, upload them to the tracker during CI and remove them from the deployed folder. Also scan the front-end code for hard-coded keys or secrets and move them to server-side environment variables.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

ECMA-426 Source map formatEcma TC39Maps minified code to original source; sourcesContent; sourceMappingURL comment
productionBrowserSourceMapsNext.jsProduction maps are off by default; enabling serves .map files next to the JS
Build Options (build.sourcemap)Vitebuild.sourcemap defaults to false; 'hidden' still writes .map but drops the comment
Advanced Configuration (GENERATE_SOURCEMAP)Create React AppGENERATE_SOURCEMAP=false stops source maps in production builds
Devtoolwebpackhidden-source-map is for error reports; do not deploy the map to the web server
Source Maps for JavaScriptSentryUpload maps to the error tracker during the build instead of hosting them publicly

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.