EngineeringScore
Exposure Small

Stop shipping source maps publicly

A source map lets browser devtools, or anyone else who fetches it, reconstruct the original, unminified source from a production JavaScript bundle, including comments, file and variable names, and code structure that was never meant to ship. It isn't a leaked credential, but it hands an attacker a much easier starting point for finding other vulnerabilities in the same codebase.

Why it matters

A published source map republishes the original, unminified source (including comments and internal structure never meant to ship), making it far easier to find other vulnerabilities in the same codebase.

How to fix

  1. 1 Stop generating or publishing source maps for production builds (most bundlers support disabling this per environment, e.g. devtool: false or a hidden-source-map mode).
  2. 2 If the team genuinely needs production source maps for error tracking, upload them privately to that tool instead of serving them publicly.
  3. 3 Remove any already-published .map files and the sourceMappingURL comments referencing them from the current build.
  4. 4 Redeploy and confirm no source map is fetchable from the deployed bundle.

Common mistakes

  • Disabling source maps for the main bundle but leaving them enabled for vendor or chunk files produced by a separate build step.
  • Assuming a source map is hidden because it isn't linked from the page, when the sourceMappingURL comment in the bundle still points to a fetchable file.
  • Turning source maps off in local development without updating the production build config, so the change never reaches what actually gets deployed.

How to verify

  1. 1 Re-run the scan and confirm no source map reference is found.
  2. 2 Request the map file's URL directly and confirm it now returns a 404 rather than the map contents.
  3. 3 Check the production build output/config directly, not just local dev settings, to confirm source map generation is actually disabled for what gets deployed.

Related checks

Exposure Secrets Stripe Secret KeyExposure Secrets Aws Access KeyExposure Secrets Private Key

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site