Source maps public

Source maps translate shipped, minified JavaScript back into readable original code. If they sit publicly next to the bundle, anyone can read your application essentially in clear text — file names, comments and internal logic included.

On its own this is not a vulnerability but an advantage for attackers: knowing the structure makes finding weaknesses far faster. It becomes critical when the original code contains keys, internal endpoints or commented-out credentials — which is common in quickly built projects.

For us this finding cuts both ways: it is precisely why our scan can look so deep into some apps. If you do not want that, disable source map output for the production build — or upload them to your error monitor instead of serving them publicly.