Skip to content

Source maps exposed in production: how to turn off

Security · Nice to fix · vibeliq reports this as “Your original source code is downloadable”

Why it matters

Source maps let anyone rebuild your readable, commented source code from the live site. That makes it much easier to find weak spots or copy your work.

How to check it yourself

Find a JavaScript file URL in your page source and add .map to the end of it in the browser. If a big JSON file downloads, anyone can rebuild your readable source code.

What the fix involves

Turn off production source maps in your bundler, or upload them privately to your error tracker and keep them off the public site.

How vibeliq checks it

We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.

Related checks

All 38 checks