Exposed source maps

A source map is the key that turns a minified script back into your original code.

What it is

Build tools write .map files next to the scripts. When they are deployed, any visitor can download them and read the original files, with names, comments and every string.

Why it matters

Original source shows how the app works, which endpoints exist and where secrets might sit. Secrets that never appeared in the minified output can still sit in the source. Tenty rates the finding by what the maps hold.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where the value appears. Tenty follows the sourceMappingURL comment of each script, reads the map and looks inside it for keys and internal addresses.

How to fix it

• Turn off production source maps in the build (build.sourcemap: false in Vite, productionBrowserSourceMaps: false in Next.js).
• Upload maps to your error tracker during the build and delete them from the deploy folder.
• Rotate any secret that the maps contained.

How to reproduce

curl -sSI 'https://YOUR-APP/assets/app.js.map'

A 200 answer means the map is public.