Production Source Map Exposure: Risks of Deployed .map Files

Source maps (*.js.map) are generated by modern bundlers to facilitate debugging by mapping minified production code back to original TypeScript, JSX, and React source files.

When .map files are left on production web servers, any visitor using browser developer tools can inspect the original unminified application source code, file structures, internal comments, and helper functions.

Vulnerability Risk & Threat Impact

Unminified source code substantially eases reverse engineering, helping attackers uncover hidden administrative endpoints, internal APIs, and logic flaws.

How Our Scanner Inspects for This Flaw

Site Check analyzes //# sourceMappingURL= directives within client script bundles and verifies whether referenced .map files are accessible over HTTP.

During configuration and secret scanning, the Site Check engine executes lightweight, non-destructive HEAD and GET probes evaluating status code responses (404/403 vs 200). Diagnostic queries adhere to safety bounds without caching payload contents to external storage, ensuring full confidentiality.

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

      // In vite.config.ts or next.config.js:
export default defineConfig({
  build: {
    sourcemap: false, // Disable source map generation for production builds
  },
});
    

• Set build.sourcemap to false in your Vite, Webpack, or Next.js build configurations.
• Purge existing *.map files from your public production server directories.
• If error debugging in production is required, upload source maps directly and privately to an error monitoring platform (such as Sentry) instead of publishing them on the web.

Attack Anatomy & Real-World Business Impact

Publishing production .map files enables any visitor to open Chrome DevTools Sources and inspect unminified TypeScript source code, revealing internal architecture, authorization endpoints, and proprietary business logic.

Compliance Framework Impact: Non-conformance with OWASP Top 10 guidelines (A05:2021 Security Misconfiguration) and corporate IP protection controls.

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

curl -I -s https://your-domain.com/index.js.map | grep "HTTP/"
# Expected: 404 Not Found
    

DevSecOps Best Practices & CI/CD Hardening

Configure sourcemap: false in your production bundler settings (vite.config.ts / webpack.config.js) or set sourcemap: "hidden" to restrict map upload to private monitoring platforms.