SniffPupFree source map exposure checker for your site
Paste your live URL to check whether anyone can download the source map for your JavaScript, and with it your original, readable source code. It's passive: SniffPup reads the files your page already loads, like a normal browser.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. A public source map is listed as “Source maps are public (your original source code is downloadable)”. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
What this checks
- The source map your JavaScript points to. SniffPup reads up to 20 same-origin JavaScript files your page loads, finds the first
sourceMappingURLcomment that points to a.mapfile on your own site, and requests it once. - Only real source maps count. It's reported only if the response is a version 3 source map with a
sourceslist, not your app's normal HTML page. - As part of the same free scan: secret keys in your HTML and JavaScript (masked), public
.envand.gitfiles, outdated JavaScript libraries, security headers and HTTPS.
What it can't tell you
- It checks the first source map it finds, not every one, and doesn't guess
.mapfiles that your JavaScript doesn't point to. - It only follows JavaScript on the site you enter, not scripts from other domains, other subdomains or pages behind a login.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It is never proof of security.
Check it yourself
Open DevTools → Sources on your live site and look for your original file names. Or, from a terminal, using one of your own JavaScript file paths:
curl -s https://your-app.com/assets/index-abc123.js | tail -c 200 curl -sI https://your-app.com/assets/index-abc123.js.map
If the end of the file has sourceMappingURL=...map and that .map URL loads, your source map is public.
How to fix it
- Turn off browser source maps for production builds in your build tool's config.
- If you need them for error tracking, upload them to your error tracker instead of publishing them.
- Redeploy, then scan again to confirm.
More: Can strangers read your app's source code? and the .env exposure checker.
Questions
What is a public source map?
Your live site ships minified JavaScript, which is hard to read. A source map (a .map file) turns it back into your original files, often with comments. It's useful while debugging, but if it's published, anyone can browse your original code and look for weak spots.
How does SniffPup check for one?
It reads the same-origin JavaScript files your page loads and looks for a sourceMappingURL comment at the end of a file. It requests the first source map it finds on your own site, once, and reports it only if the response really is a source map (version 3 with a sources list). It doesn't guess other .map file names.
Is a public source map a leak of my secret keys?
Not by itself, and it's reported as low severity. It makes your code easier to read and attack. Secret keys are a separate check in the same scan: SniffPup looks for them in your HTML and JavaScript and masks any it finds.
How do I turn source maps off?
It depends on your build tool. In Vite, build.sourcemap is off by default, so check you haven't turned it on (or set it to "hidden", which still writes the files but drops the link to them). In Next.js, productionBrowserSourceMaps is off unless you enable it. Then redeploy and scan again.
Does a clean result mean my code is private?
No. Your JavaScript is always public, minified or not. A clean result means the source map your JavaScript points to wasn't downloadable at scan time. It doesn't check .map files that aren't referenced, other subdomains or pages behind a login.