Check whether your production source maps are public

What the checker answers

Can a visitor retrieve a map linked from deployed JavaScript?

Source maps reconnect minified JavaScript to its original source. They are valuable for debugging, but a publicly reachable production map can reveal source structure, readable names, routes, comments, and sometimes server-adjacent file paths. Public maps are not automatically a vulnerability; they should be an intentional deployment decision.

SiteGuardrail reviews public first-party scripts, follows an observable map reference within the allowed origin, and confirms that the response looks like a map before reporting it. The evidence identifies the affected public URL without reproducing source contents.

Result states

Interpret the result without overclaiming.

Fix by build system

Keep debugging visibility without publishing source unintentionally.

Next.js

Next.js disables browser production source maps by default. Confirm that productionBrowserSourceMaps has not been enabled unless public maps are deliberate. If error monitoring needs maps, upload them privately during the build and remove them from the public artefact afterwards.

// next.config.ts
const nextConfig = {
  productionBrowserSourceMaps: false,
}

export default nextConfig

Vite

Vite's production build.sourcemap default is false. Remember that the hidden option suppresses the bundle comment but still creates a map file, so it is not a confidentiality control if the file remains publicly deployed.

// vite.config.ts
export default defineConfig({
  build: { sourcemap: false },
})

Response plan

If the map was not meant to be public

1. Remove the map and its public reference from the production artefact.
2. Purge the deployment/CDN cache and confirm the old URL no longer returns it.
3. Review whether the map contained sensitive paths, comments, routes, or embedded source content.
4. Rotate any genuine secret discovered in source; deleting the map alone is not enough.
5. Run the focused check again after deployment.