[{"data":1,"prerenderedAt":305},["ShallowReactive",2],{"blog-en-source-maps-exposed-in-production":3},{"id":4,"title":5,"body":6,"category":262,"cover":263,"coverAlt":263,"description":264,"draft":265,"extension":266,"faq":267,"image":283,"keywords":284,"meta":292,"navigation":293,"ogTitle":294,"path":295,"published":296,"seo":297,"stem":298,"tldr":299,"updated":296,"__hash__":304},"blog_en\u002Fblog\u002Fsource-maps-exposed-in-production.md","Source maps exposed: your app is publishing its original code",{"type":7,"value":8,"toc":251},"minimark",[9,13,16,21,24,27,30,44,48,51,54,65,71,74,78,81,107,110,118,122,125,128,136,139,143,146,149,154,161,165,168,171,181,196,203,207,235,243],[10,11,12],"p",{},"You scanned your app, and one line of the report says your original source code\nis published. Or someone technical pressed F12 on your site and told you your\nsource maps are exposed. Either way it sounds bad in a specific, personal way:\nthe thing you spent months building is apparently lying in the open, comments\nand all.",[10,14,15],{},"Both the alarming reading and the shrug are wrong. A source map is not a secret.\nIt is a map (the name is literal) to where your secrets would be, if any were\never written into your code. Whether yours matters comes down to what is in\nthere, and checking takes about 30 seconds.",[17,18,20],"h2",{"id":19},"is-it-bad-that-your-source-maps-are-exposed","Is it bad that your source maps are exposed?",[10,22,23],{},"It is worth fixing this week. It is rarely worth panicking about tonight.",[10,25,26],{},"What an exposed source map reveals is code, and your app already hands its code\nto every visitor, compressed into an unreadable block, but present, because\nthat is how the web works. A patient stranger with the right tools could\nreconstruct a rough version of it from the compressed file alone. The map\nremoves the patience requirement: with it, anyone who presses F12 reads your\nproject laid out the way it looks in your editor.",[10,28,29],{},"Our scanner files a published source map as a medium, the middle of the\nseverity scale, and that placement is deliberate. On its own, readable code is\na loss of privacy: someone can study how your app works, read your\nhalf-finished features, borrow your ideas. Unpleasant, and for an app whose\nvalue is a clever prompt or an unusual flow, a genuine business problem. Not an\nopen till.",[10,31,32,33,38,39,43],{},"The weight changes the day your code contains something that was never meant to\nbe code. A key that runs as part of your app ends up in the compressed file\ntoo. A map makes it easier to find, but it was already published, and that is\n",[34,35,37],"a",{"href":36},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","its own, bigger finding",".\nComments are different. Compression deletes them from what ships, so the map is\nthe only public place a comment exists. A password in a commented-out line, a\n",[40,41,42],"code",{},"remove before launch"," note above the thing that never got removed, an internal\naddress you jotted down next to the function that calls it. Those live nowhere\na stranger can reach except the map.",[17,45,47],{"id":46},"what-a-source-map-actually-is","What a source map actually is",[10,49,50],{},"It is the translation between the code your site ships and the code you wrote.",[10,52,53],{},"When your app is published, the build step compresses your code: every file\nsqueezed together, every name shortened to a letter or two, every comment\nstripped, the whole thing on one enormous line. Browsers run that happily.\nNobody can read it, including the tools that built it, which becomes a problem\nthe moment something crashes and the error points at line 1, character 48,120\nof a file no human has ever seen.",[10,55,56,57,60,61,64],{},"So build tools write a second file, the source map. It sits next to the\ncompressed one (",[40,58,59],{},"app.js"," gets ",[40,62,63],{},"app.js.map",") and holds everything the\ncompression threw away: your original files, their names, their folder layout,\nand every comment. The last line of the compressed file carries the map's\naddress, and a browser fetches the map when its developer tools open. That is\nthe whole design. It exists so an error can point at the code you actually\nwrote.",[66,67],"diagram",{"alt":68,"caption":69,"src":70},"On the left, a compressed bundle file drawn as a wall of unreadable dashes, with its source map file beneath it. A chevron leads right to the same app rendered as a readable project: a src folder, component files, and lines of code in which two comment lines are highlighted in amber.","The compressed file is what your visitors run. The map turns it back into the project you wrote. The comments, stripped from the bundle, exist only on the readable side.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fwhat-the-map-reveals-1600x720.png",[10,72,73],{},"Two things follow from that design. Your visitors never download the map (a\nbrowser only asks for it when developer tools open), so a published map costs\nnothing, changes nothing on screen, and never announces itself. And anything\nthat can open your site can fetch it, because the address is written in the\npage and there is no login in front of it. Whether the file is up there is a\nbuild setting, and from the outside, switched on looks exactly like switched\noff until someone goes looking.",[17,75,77],{"id":76},"how-to-check-your-app-in-30-seconds","How to check your app in 30 seconds",[10,79,80],{},"On your live app, the published address your users visit, not the preview\ninside your builder:",[82,83,84,88,96],"ol",{},[85,86,87],"li",{},"Open the app in Chrome, Edge or Firefox and press F12. This opens the\nbrowser's developer tools, the same panel a stranger would use.",[85,89,90,91,95],{},"Click the tab called ",[92,93,94],"strong",{},"Sources"," along the top of the panel.",[85,97,98,99,102,103,106],{},"Read the file tree on the left. Compressed code looks like one or two files\nwith names like ",[40,100,101],{},"index-4f81ab2c.js",". Source maps look like your project: a\nfolder called ",[40,104,105],{},"src",", files named after your pages and components, and code\ninside them you can actually read.",[10,108,109],{},"If you can open a file there and see your own comments, your source maps are\npublished. The browser only draws that tree because it fetched the map from\nyour live site, exactly the way anyone else's browser would.",[10,111,112,113,117],{},"If you would rather not poke around in panels, our free scan reads your live\nsite from the outside and reports this check along with eight others:\n",[34,114,116],{"href":115},"\u002F#scan","scan your app",". It takes about 20 seconds and needs no account.",[17,119,121],{"id":120},"what-a-stranger-can-see-and-what-they-cannot","What a stranger can see, and what they cannot",[10,123,124],{},"Everything you wrote into the app itself, and nothing past it.",[10,126,127],{},"Published source maps reveal your frontend: your pages, your components, the\nlogic that runs in the browser, the names of the routes your app calls, any\nprompt you wrote into the app, and every comment.",[10,129,130,131,135],{},"They do not reach your server. Code running in an edge function or a backend\nstays where it is. They do not open your database either. Whether a stranger\ncan read your tables is decided by the rules on each table, not by your code\nbeing visible, and\n",[34,132,134],{"href":133},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","we measured that question separately","\nacross the same apps.",[10,137,138],{},"In practice, damage from a published map arrives as quiet reading rather than a\ndramatic break-in: someone studies your checkout logic for a way around it, or\nfinds an admin route nobody ever linked to and tries it. Each of those becomes\na problem only if the thing they found was unprotected. The map is a guide for\na stranger; it is not itself the open door.",[17,140,142],{"id":141},"how-often-published-source-maps-turn-up","How often published source maps turn up",[10,144,145],{},"In August 2026 we scanned 30,998 live apps published from Lovable, Base44,\nReplit, v0 and Bolt. One in eight (13%) was serving at least one working\nsource map.",[10,147,148],{},"We count a map only when it actually answers. The address at the bottom of a\ncompressed file proves nothing by itself, because plenty of builds write the\naddress and never upload the file; our scanner follows it and checks that a\nreal map comes back. And where the check could not complete, we recorded that\nit could not complete. An app we failed to check is unknown, not clean.",[66,150],{"alt":151,"caption":152,"src":153},"A compressed bundle file ending in the line sourceMappingURL=index-4f81.js.map, with two possible outcomes drawn beneath it. In one, the request for the map returns 200 with a JSON file and is marked with an amber cross: the code is published. In the other it returns 404 and is marked with a green tick.","The address alone proves nothing. The finding is a map that answers. A 404 at that address means the setting is off, whatever the last line of the bundle says.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fdoes-the-map-answer-1600x640.png",[10,155,156,157,160],{},"Two other numbers from the same sweep put this one in its place. The leak\nowners are warned about most (a secret key in the page, the kind that ignores\nevery database rule) turned up 3 times in those 30,998 apps. And a database\ntable readable by any stranger turned up in\n",[34,158,159],{"href":133},"more than half of the apps where we could complete that check",".\nExposed source maps sit between the two: far more common than the famous leak,\nfar less directly damaging than the open table. Which is what a medium\nseverity is trying to tell you.",[17,162,164],{"id":163},"how-to-turn-source-maps-off-in-production","How to turn source maps off in production",[10,166,167],{},"One build setting, then a redeploy.",[10,169,170],{},"If a builder made your app, tell it in plain words:",[172,173,178],"pre",{"className":174,"code":176,"language":177},[175],"language-text","Disable source map generation for production builds and redeploy.\n","text",[40,179,176],{"__ignoreMap":180},"",[10,182,183,184,187,188,191,192,195],{},"If you manage the code yourself, the setting lives in the build configuration.\nIn a Vite project (which is what most Lovable and Bolt apps are underneath)\nthat is ",[40,185,186],{},"build.sourcemap: false"," in ",[40,189,190],{},"vite.config","; a Nuxt app has its own\n",[40,193,194],{},"sourcemap"," option. Redeploy, then repeat the 30-second check: the readable\nfile tree under Sources should be gone, and only the compressed names should\nremain.",[10,197,198,199,202],{},"Two follow-ups before you file this as done. Turning maps off does not recall\nthe copies. Anyone who fetched your map while it was up still has your code\nas it was that day. So read your own source before you relax: if a key, a\npassword or anything else that should not be public is written anywhere in it,\n",[34,200,201],{"href":36},"rotate it now","; removing the\nmap closes the door on new readers, not on what was already copied. And the\nsetting can come back: a template update, a regenerated config or a new\ndeployment target can switch maps on again without you touching anything.",[17,204,206],{"id":205},"what-to-do-right-now","What to do right now",[208,209,210],"key-takeaways",{},[211,212,213,219,226,229,232],"ul",{},[85,214,215,216,218],{},"Press F12 on your live app, open Sources, and look for a folder called ",[40,217,105],{},". Readable files with your own comments mean your source maps are published.",[85,220,221,222,225],{},"Turn them off with one instruction to your builder (disable source maps for production builds and redeploy) or set ",[40,223,224],{},"sourcemap: false"," in the build config yourself.",[85,227,228],{},"Read what the map was revealing before you relax. A key or password anywhere in your source means rotating it today, because removing the map does not take back copies already made.",[85,230,231],{},"Leave development source maps alone. They are doing their job, and only the published site is in question.",[85,233,234],{},"Repeat the 30-second check after template updates and big redeploys. This setting has a way of coming back on its own.",[10,236,237,238,242],{},"That last habit is the one that slips, because nothing looks different when the\nanswer changes. Reeve Care re-runs this same scan against your live app on a\nschedule, this check included, and emails you when a result gets worse:\n",[34,239,241],{"href":240},"\u002F#pricing","what it watches and what it costs",".",[10,244,245,246,250],{},"If you would rather close everything in one sitting, the\n",[34,247,249],{"href":248},"\u002Fchecklist","10-minute security checklist"," covers this alongside the other\ndoors worth checking in a newly launched app.",{"title":180,"searchDepth":252,"depth":252,"links":253},3,[254,256,257,258,259,260,261],{"id":19,"depth":255,"text":20},2,{"id":46,"depth":255,"text":47},{"id":76,"depth":255,"text":77},{"id":120,"depth":255,"text":121},{"id":141,"depth":255,"text":142},{"id":163,"depth":255,"text":164},{"id":205,"depth":255,"text":206},"Security basics",null,"An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.",false,"md",[268,271,274,277,280],{"q":269,"a":270},"Someone told me my source maps are exposed. Is that a data breach?","No. A source map contains your code, not your users' data. Your database is not in it and neither is anything from your server. It turns serious only when the code itself holds something secret: a key, a password, an internal address. Read what is actually written in yours before deciding how bad the news is.",{"q":272,"a":273},"Can someone steal my app if my source maps are public?","They can read your frontend code (pages, components, browser logic and comments), which makes copying your app's ideas easier than it already was. They do not get your server code, your database or your users. For most apps the practical risk is not theft of the code; it is whatever secret got written into the code along the way.",{"q":275,"a":276},"How do I remove source maps from my production build?","Tell your builder, in plain words: disable source map generation for production builds and redeploy. If you manage the code yourself, set sourcemap to false in your build configuration (in a Vite project that is build.sourcemap in vite.config) and deploy again. Then re-check with F12: the readable file tree under Sources should be gone.",{"q":278,"a":279},"Are source maps in development a problem too?","No. Source maps exist for development. They are what makes an error message point at the real file and line you wrote instead of somewhere in one enormous compressed line. Your dev preview is somewhere only you look. The only question that matters is whether your published site serves them to the world.",{"q":281,"a":282},"My scan says my original source code isn't published. Am I safe?","It means no working source map answered when we looked, nothing more. Your compressed code is still public, as every app's is, and a later redeploy can quietly change the answer, which is why the check is worth repeating after big changes.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",[285,286,287,288,289,290,291],"source maps exposed production","source map exposed","exposed source maps","remove source maps from production","is it bad to publish source maps","sourceMappingURL","vite sourcemap false",{},true,"Source maps exposed: is your app publishing its code?","\u002Fblog\u002Fsource-maps-exposed-in-production","2026-08-18",{"title":5,"description":264},"blog\u002Fsource-maps-exposed-in-production",[300,301,302,303],"An exposed source map lets anyone read your app's original source code (components, logic and every comment) straight from their browser.","It is not a breach by itself. Code is not a secret. But a source map is a map to where your secrets would be, if any were ever written into your code.","One in eight of the 30,998 vibe-coded apps we scanned in August 2026 was publishing its source maps.","The check takes 30 seconds in your browser, and the fix is one build setting.","Go8lakhTHVAR_bK1xqipN13dvMeNWCTbOsCBd2n2qIE",1787826048204]