Source maps not exposed
Source maps are files (.js.map) generated during the build process that allow developer tools to remap minified/bundled code back to the ori…
Analyse my site for freeUnderstanding "Source maps not exposed"
Modern build tools (Webpack, Vite, esbuild…) minify JavaScript code for production: stripping whitespace and comments, renaming variables to single letters. This reduces file size but makes the code unreadable for debugging. To solve this, these tools generate source maps (.js.map files) that link the minified code back to the original source, letting browser dev tools display readable code with correct line numbers.
The problem: if these .map files are deployed and publicly reachable in production, anyone can load them into their browser's dev tools to reconstruct the entire original source code — comments, explicit variable and function names, full business logic.
How TheSiteFuse checks "Source maps not exposed"
TheSiteFuse identifies up to 3 <script src="...js"> files loaded by the page, then tests each one for the existence of the corresponding .map file (e.g. main.js → main.js.map), handling relative, absolute and protocol-relative URLs. If at least one .map file responds 200 with substantial content (more than 100 bytes), the check flags an exposure. No external JavaScript files, or no associated .map files, is considered correct.
Why "Source maps not exposed" matters
- Business logic exposure — pricing calculation algorithms, validation rules, client-side permission logic become readable and therefore bypassable.
- Leak of secrets left in code — API keys or undocumented internal endpoint URLs are sometimes accidentally hardcoded in source; minified code visually hides them, the source map reveals them in full.
- Application mapping — the complete structure of components, internal routes and frontend architecture becomes visible, making it easier to search for targeted flaws.
- Lost competitive advantage — for a proprietary application, source code represents a significant investment; exposing it makes it easier for competitors to copy features.
Fix "Source maps not exposed" step by step
Webpack — disable source maps in production
// webpack.config.js
module.exports = {
mode: 'production',
devtool: false, // or 'hidden-source-map' to keep them internally (Sentry) without exposing them
};
Vite
// vite.config.js
export default {
build: {
sourcemap: false,
},
};
If you need source maps for an error-monitoring tool (Sentry, Bugsnag)
Generate them and upload them directly to the monitoring tool via its CLI during the build, without deploying them to the public server. This is the recommended approach: you keep precise production error debugging without exposing source code to visitors.
Alternative — block public access to .map files
# Nginx
location ~* \.js\.map$ {
deny all;
}
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Source maps not exposedDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.