Glossary / AI & Vibe Coding
Source Map Leak
A source map leak is when the .map files that browsers use to debug minified code are served publicly in production. Anyone can download them to reconstruct your original, unminified source, including comments, file structure and any logic or secrets you assumed were hidden in the bundle.
What is a source map leak?
A source map leak is when the .map files that browsers use to debug minified code are served publicly in production. Anyone can download them to reconstruct your original, unminified source, including comments, file structure and any logic or secrets you assumed were hidden in the bundle.
Key takeaways
- A served .map file reconstructs your original source, comments and structure.
- Minification is not security; a source map removes even that thin cover.
- On its own it is a disclosure risk; it becomes a breach when the source reveals a key or admin route.
- Stop shipping maps to production, or gate them behind auth.
Why it matters
Minification is not security, but many teams treat it as if it were, assuming nobody can read their shipped JavaScript. A served source map removes even that thin cover, exposing internal logic, endpoint names and sometimes credentials that were never meant to be readable.
Common mistakes we see
Source map leaks are almost always accidental. A default build config produces .map files, the deploy uploads the whole output folder, and nobody notices because the app works fine without anyone requesting the maps. Then a curious visitor, or an automated scanner, appends .map to a bundle URL and downloads your entire codebase in readable form. We see this constantly on vibe-coded and quickly-shipped sites, because the fast path is "deploy everything" and the security step is a setting most people never open. On its own a source map is a disclosure risk, not a breach. It becomes a breach when the readable source reveals a hardcoded key, an internal admin route, or a client-side check that was doing the job the server should have been doing. Our guidance is to stop shipping maps to production, or to gate them behind auth, and to never let the bundle be the thing keeping a secret. If a secret only stays safe because the code is hard to read, it is already leaked.
Before you deploy the front end
- No .map file is publicly reachable in production.
- No secret survives only because the code is hard to read.
- Error monitoring uploads maps privately, not to the public bundle.
Example
A dashboard ships main.min.js.map to production. A scanner pulls it, reconstructs the source, and finds a hardcoded admin API token in a comment left by the AI tool that generated the file. Minification hid it; the map revealed it.
Related terms
Check your site for exposed source maps
Our free, passive website security check flags public source maps, exposed files and secrets in shipped JavaScript.
Check your site for exposed source maps
