VibeSecurity

Security check

Exposed source maps: what production builds reveal

Source maps translate minified bundles back into readable source for debugging. Served publicly, they hand anyone your full front-end code, comments and file structure, which makes finding a mistake much easier.

By the VibeSecurity team1 min read

How to tell if you ship them

  • Open a JavaScript file from your live site and look at the last line for a sourceMappingURL comment.
  • Request the .map file it points to. A successful download means maps are public.

Turn them off or keep them private

Next.js next.config.ts
const nextConfig = {
  productionBrowserSourceMaps: false,
};
export default nextConfig;

Vite

vite.config.ts
export default defineConfig({
  build: { sourcemap: false },
});

What maps do not fix

Removing maps does not hide secrets. Minified code can still be read, so no secret belongs in a front-end bundle in the first place.

Frequently asked questions

Do I lose error tracking if I remove maps?

No. Most trackers let you upload maps privately at build time and never serve them publicly.

Sources

  1. 1.Next.js docs: productionBrowserSourceMaps
  2. 2.Vite docs: build.sourcemap