Exposed source maps: your original source code is downloadable
If .map files ship to production, anyone can reconstruct your original, unminified source — comments, structure, and sometimes secrets. Here is how to turn them off.
A source map (.js.map) tells the browser how minified production code maps back to your original files. They're great in development and a liability in production, because anyone can download them and rebuild your original source — folder structure, comments, and any secrets left in code.
Why it matters
Exposed source maps hand attackers a readable copy of your app to study for weaknesses, and frequently re-expose secrets that minification had obscured. Shipshape reconstructs source from any exposed map and re-scans it for keys.
The fix
- Vite: set
build.sourcemap: falseinvite.config.js(or'hidden'to keep them for error tools without serving them publicly). - Next.js: set
productionBrowserSourceMaps: falseinnext.config.js. - Or stop your host from serving
.mapfiles. Then redeploy and re-scan.
FAQ
Are source maps a security risk?
In production, yes — they let anyone download and rebuild your original source code, and often re-expose secrets that minification hid. They are fine to keep private for error reporting.
How do I disable source maps?
Set build.sourcemap to false in Vite, or productionBrowserSourceMaps to false in Next.js, then redeploy. “hidden” mode keeps them for error tools without serving them publicly.
Related questions
- Unvalidated postMessage: a cross-window message handler without an origin check
- Subdomain takeover: a dangling DNS record an attacker can claim
- Debug artifacts, risky TODOs, and leaked AI prompts in your build
- TLS and email checks: weak HTTPS and a spoofable domain