Public source maps expose your source code: how to disable them
Medium
Source maps (.js.map files) are downloadable for your production JavaScript. They contain your original, readable source code, including comments, file structure and any secrets you thought were hidden by minification.
Why it matters
They're useful for debugging but shouldn't be public on production. They make it much easier for attackers to understand your app and find weak spots.
Quick fix
- Vite: set build.sourcemap to false (or 'hidden' and upload maps to your error tracker).
- Next.js: make sure productionBrowserSourceMaps is not set to true.
- Redeploy, and check that yourfile.js.map now returns 404.
Step by step
Vite (Lovable, Bolt and most React apps)
// vite.config.ts
export default defineConfig({
build: { sourcemap: false }, // or "hidden" + upload to Sentry
});Next.js
Source maps are off for browsers by default. Remove productionBrowserSourceMaps: true from next.config.js if present.
Error tracking
If you use Sentry or similar, generate hidden source maps, upload them during the build, then delete them from the output folder.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
Disable public source maps in my production build. For Vite set build.sourcemap to false (or 'hidden' if we upload maps to an error tracker, and make sure .map files are deleted from the deployed output). For Next.js ensure productionBrowserSourceMaps is not enabled.FAQ
Do source maps leak secrets?
They expose exactly what's already in your bundle, but in readable form with comments and original file names. If a secret is in a source map, it was already in your JavaScript.