← Back to the Source Map Leak Checker

How source maps leak in production

A source map only becomes a problem when a production deployment leaves it publicly reachable. There are four common, independent ways that happens, and each has its own fix -- fixing one does not fix the others.

1. The dev devtool setting shipped to production

Many starter configs use the same devtool (webpack) or build.sourcemap (Vite) setting for both dev and prod builds. webpack's plain 'source-map' mode writes a full map with sourcesContent and adds a //# sourceMappingURL= comment to the shipped script -- exactly what you want on your own machine, and exactly what you don't want served publicly. 

// webpack.config.js
module.exports = {
  devtool: process.env.NODE_ENV === 'production'
    ? 'hidden-source-map'   // map is still generated, but no comment references it
    : 'eval-source-map',    // fast, full detail, dev only
};

hidden-source-map still produces a real map you can upload to an error-tracking service (Sentry and similar all support this) for real stack traces on production errors -- it just never adds the reference a browser (or this checker) would follow.

2. The deploy step copies .map files it shouldn't

Even with the right devtool mode, a build step that copies the whole output directory to the CDN or server will ship any .map file still sitting on disk. Exclude it explicitly: 

# rsync example
rsync -av --exclude='*.map' dist/ user@host:/var/www/app/

3. No server/CDN rule blocking .map as a second layer

Defense in depth: even if a map ends up in the deploy artifact by accident, a rule that returns 404 for any path ending in .map means the script's own reference leads nowhere. This is the "blocked" result this checker reports as the healthy outcome when a reference exists but the file itself is not actually served. 

# nginx example
location ~ \.map$ {
  return 404;
}

4. A vendor or third-party bundle carries its own reference

A pre-built vendor chunk -- a bundled UI library, an analytics SDK, anything pulled in as a finished artifact rather than compiled from your own source -- can carry its own sourceMappingURL comment independently of your build config. Check every script tag the page actually loads, not just the entry bundle you wrote yourself.

Run the Source Map Leak Checker against your production URL (or paste the specific script URLs) to see which of these, if any, apply to your deployment right now. Only run it against a site you own or are authorised to test.