← All posts

Can strangers read your app's source code?

Your live site ships minified JavaScript, which is hard to read. A source map turns it back into your original files, comments and all. That's great while debugging, but if the .map files go live, anyone can browse your code and look for weak spots. It's an easy one to miss in AI-built apps.

Check in 1 minute

  1. Open your site, then DevTools → Sources and look for your original file names.
  2. Or open one of your JS files and scroll to the bottom. If it ends with sourceMappingURL=...map, open that URL. If it loads, it's public.

Fix it

  1. Vite: set build.sourcemap: false in your config.
  2. Next.js: keep productionBrowserSourceMaps off (the default).
  3. Redeploy, then check the .map URL returns 404.

Want a second nose? Run a free scan at sniffpup.com.