Source maps in production: what they show and how to stop publishing them

What a public source map shows

Your bundle usually ends with a line like //# sourceMappingURL=index-abc123.js.map. Browsers' developer tools follow that line, download the map, and show the original files. When the map includes sourcesContent, the full original code is inside it. That reveals:

• your file and folder names, and the structure of your app,
• comments, TODOs and internal URLs,
• logic you might not want on show, such as how pricing or feature flags are worked out.

A source map doesn't add new secrets by itself: any key in your front-end code is already in the bundle. It does make that code much easier to read and search.

Turn source maps off

Vite (React, Vue, Svelte): the build.sourcemap option defaults to false. If your config sets it to true, change it back, or use 'hidden', which Vite describes as working "like true except that the corresponding sourcemap comments in the bundled files are suppressed" (the .map files are still written, so don't deploy them).

// vite.config.js
export default {
  build: { sourcemap: false },
};

Next.js: browser source maps are off in production builds unless productionBrowserSourceMaps: true is set. Next.js says they are disabled "to prevent you leaking your source on the client". Remove the flag if you don't need it; when it's on, "Next.js will automatically serve these files when requested."

Create React App: set GENERATE_SOURCEMAP=false in the build environment. Its docs: "When set to false, source maps are not generated for a production build."

Want readable error reports? Error trackers such as Sentry can take your source maps as a private upload during the build, so stack traces stay readable without the maps being public. Delete the .map files from the deploy folder after the upload.

Confirm the fix

1. Open your live site, open developer tools, and look at the last line of your main script. The sourceMappingURL comment should be gone.
2. If you used 'hidden' or an upload step, open the old map URL directly. It should return a 404.

What Pewterkit Check looks at

The check reads the end of each script your home page loads for a sourceMappingURL comment that points to a .map file, then requests that one file. It reports a finding only when the file really is a source map (it has mappings), and says whether it also contains the original source (sourcesContent). Maps that are referenced but not served are reported as OK.