Production builds shrink and combine your code so it loads fast, which makes errors hard to read. Source maps solve that by recording how each piece of the output maps to the original files, and browsers use them to show the real code in developer tools.
Many build tools can emit source maps for production, and some hosting setups deploy them by default. When they are public, a visitor can reconstruct your full frontend source, including comments, internal routes, feature flags and any secret that was hardcoded. It does not create the leak, since the shipped bundle already contains those values, but it makes them trivial to find.
Disable public source maps for production, or upload them privately to an error tracking service and keep them off the web server. Remember that hiding maps never makes a secret safe; anything in frontend code should be treated as public.
export default defineConfig({
build: { sourcemap: false },
});