diagnostic · one of 36 Pro breakdown
Source maps
Is my source code exposed in production?
A source map shipped to production hands back the original code, the folder structure it was organised in, and sometimes the absolute path of the machine that built it. Most of the time it is an unchanged default rather than a decision, and nothing in the browser mentions it.
Reach it Press ⌘ + K on any tab and type source maps. Ctrl + K on Windows and Linux
in the panel · this one is Pro
What this actually is
bundles serving a map, and what they exposeBefore a launch, and on any site inherited from somebody else. It is worth being clear that a served map is not automatically a vulnerability: plenty of teams ship them deliberately so error reports are readable. The point is to know which of the two you are doing.
Asked about this diagnostic
3 of themAre source maps in production actually a problem?
They are a decision rather than a bug. Plenty of teams ship them on purpose so their error reporting is readable. The finding is that they are readable by everybody, and whether that is acceptable is yours to say.
Does it download my source?
It reads the map’s index of paths, not the file contents behind them, and nothing it reads leaves your browser.
It says the reference exists but the map is missing.
That is the healthy state: the comment is harmless on its own, and the file it points at is not being served. The row is kept so you can see the comment is there if you would rather strip it too.
how to use source maps
- Open Source maps on the production build rather than on a local one.
-
It reads
sourceMappingURLcomments and checks whether each map actually resolves. - Read the paths a resolving map would hand back - the folder tree, sometimes the build machine.
- Decide deliberately. A served map is not automatically a vulnerability, but it should not be a default.
written about at length
70 of these · no host permissions · three free audits