Exposed source maps: how to check and turn them off

By Shinobi Tech, the team behind AppLeakWatch. Updated .

A source map links your minified JavaScript back to your original code. If .map files are public on a live site, anyone can read your code, comments and file names. Turn them off for production, or keep them private.

Why this happens

Build tools can produce source maps to help with debugging, and a config change or generated setup can leave them switched on when you deploy.

How to check

  1. Find your script names, then try adding .map to one:
    curl -I https://yourdomain.com/assets/index-abc123.js.map
  2. A 200 response with JSON content means the map is public.
  3. Look at the end of your JavaScript file for a sourceMappingURL comment.

How to fix it

  1. In Vite, turn them off for production:
    export default {
  build: { sourcemap: false },
};
  2. In Next.js, keep this setting off:
    module.exports = {
  productionBrowserSourceMaps: false,
};
  3. Redeploy and repeat the check. If your error tracker needs maps, upload them to it privately.

Prompt for your AI tool

Check this project's production build settings and make sure source maps are not published. If an error tracker needs them, upload them privately instead. Show me what you changed and how to confirm it on the live site.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Are source maps always bad?

No. They're useful in development and in private error tools. The risk is serving them to everyone.

Does turning them off hide my secrets?

No. A key in browser code can still be read from the minified file. Secrets must stay on the server.

Related guides