AppInspected

Fix guides

Your source maps are public. Anyone can read your original code.

Last reviewed October 16, 2026 against the providers' current documentation.

The short version

Turn off browser source maps in your production build, or generate them as hidden maps and upload them to your error tracker instead of deploying them. Then redeploy and confirm the .map URLs no longer load. Source maps don't leak anything that isn't already in your JavaScript, but they make it far easier to read, so check that code for secrets too.

Why it matters

A source map links the minified JavaScript your users download back to the files you wrote, often including their full original text. With the map public, anyone can browse your client code as neatly as you do: file names, comments, internal API routes, feature flags and any key that ended up in browser code.

Fix it, in this order

  1. Confirm it's exposed

    Open your site, view the page source, and open one of the main .js files. If the last line is //# sourceMappingURL=something.js.map, open that URL in a private window. If it downloads JSON with "sources" and "mappings" in it, your maps are public. Our free check does this for you.

  2. Vite (Lovable, Bolt and most React apps)

    Vite's build.sourcemap option is off by default, so something turned it on. In vite.config.ts, remove it or set it to false:
    export default defineConfig({
  build: { sourcemap: false },
});
    If you need maps for error tracking, 'hidden' still writes the files but leaves out the sourceMappingURL comment; the files are still in your build folder, so the next step matters.

  3. Next.js

    Next.js doesn't create browser source maps for production unless productionBrowserSourceMaps: true is in next.config.js. Remove that line or set it to false. When it's on, Next.js serves the map files next to your JavaScript.

  4. Keep maps out of the deployed folder

    If you upload maps to an error tracker, delete them from the build output before deploying. Sentry's Vite plugin, for example, has a filesToDeleteAfterUpload option for exactly this.

  5. Redeploy and recheck

    Deploy, then load the old .map URL again. Your host may still serve a cached copy for a while, and old copies may already be saved elsewhere, which is why the next step matters.

  6. Look for secrets in the client code

    Search your frontend code for anything that looks like a key or password. If a secret key is in browser code, removing the map doesn't help: it's in the minified JavaScript too. Rotate it and move the call to a server (see the related guides).

Or ask your AI tool to do it

Paste this into Lovable, Bolt, Cursor, Claude Code or whichever tool built your app. Review what it changes before you deploy.

My production build is publishing JavaScript source maps (.map files). Turn off browser source maps for production builds: in Vite set build.sourcemap to false (or 'hidden' only if we upload maps to an error tracker, and then delete the .map files from the build output before deploy); in Next.js remove productionBrowserSourceMaps or set it to false. Make sure no .map file ends up in the deployed folder. Then search all client-side code for API keys, secrets, passwords or private URLs and list anything that must move to the server.

How this happens

Source maps are on during development because they make debugging easy. They end up in production when someone turns them on to debug a live problem, or when an error-tracking setup generates them and the files get deployed along with the app.

Check that it's really fixed

After you deploy, run the free check. It reads your live site the way an attacker would and tells you if any secret key is still visible.

Check my app free

Questions

Do source maps expose my server code or database?

No. They only cover code that's already sent to the browser. The risk is that they make that code much easier to read and search.

Is this as bad as a leaked key?

Usually not on its own. Our free check rates it medium. It becomes serious when the readable code reveals a secret or an unprotected API route.

Sources

Related guides