VibeSecurity

Keys and secrets

What is Source map?

A source map is a file that links your minified, bundled JavaScript back to your original source code so debuggers can show readable code. If published to production, it lets anyone read your unbundled frontend source.

Production builds shrink and combine your code so it loads fast, which makes errors hard to read. Source maps solve that by recording how each piece of the output maps to the original files, and browsers use them to show the real code in developer tools.

Many build tools can emit source maps for production, and some hosting setups deploy them by default. When they are public, a visitor can reconstruct your full frontend source, including comments, internal routes, feature flags and any secret that was hardcoded. It does not create the leak, since the shipped bundle already contains those values, but it makes them trivial to find.

Disable public source maps for production, or upload them privately to an error tracking service and keep them off the web server. Remember that hiding maps never makes a secret safe; anything in frontend code should be treated as public.

Vite: no public maps in production
export default defineConfig({
  build: { sourcemap: false },
});

Related terms

Sources

  1. 1.MDN: Source map
  2. 2.Vite: Env variables and modes