RoastMyOpsec

Vulnerabilities

Production Source Maps: When They Leak Source and Secrets

April 24, 2025

Production source maps leak when a public .js file points at a reachable .map, or when maps are uploaded next to hashed assets without access control. Maps are a debugging aid: they reconstruct original filenames, comments, and sometimes strings you thought the bundler ate. They are not a remote-code exploit by themselves. They are an intel and secrets-adjacent exposure. RoastMyOpsec looks for sourceMappingURL breadcrumbs and sensitive paths on the public root; keep maps off production or serve them only to authenticated debug sessions.

The practical difference

Minified JavaScript is still logic, but it slows humans down. A source map gives the original layout back. That helps your team in staging. It also helps anyone reading the production CDN.

Hidden source maps (no sourceMappingURL, maps not uploaded) keep production noisy. Hidden does not mean secret if a predictable URL still serves the file.

How to choose based on the environment

Local and staging: maps on, error tracking on. Production: maps off at the CDN, or behind auth for a break-glass debug host. If you upload maps to an error product, restrict that project and do not also leave .map public on the site.

EnvironmentSource mapssourceMappingURLTakeaway
LocalOnFineSpeed of debug wins
Shared stagingOn if the host is gatedFine behind authDo not copy prod DNS to an open staging bucket
Production CDNOff, or auth-onlyOmitDo not ship maps next to index.html
Error tracker uploadPrivate projectNot required on the public fileOne private copy is enough

When maps become a vulnerability-adjacent miss

Comments, internal URLs, feature flags, and accidentally bundled .env references show up more clearly in maps. Combined with an exposed .git, you get a full reconstruction kit.

Fix by stopping the upload, removing sourceMappingURL from prod bundles, and denying *.map at the edge if anything still answers.

Common mistakes

The first mistake is 'hidden-source-map' that still writes files to /static.

The second mistake is enabling maps to debug one production incident and leaving them on.

The third mistake is assuming a content hash in the filename makes the map unguessable when the .js file names it in the last line.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Are production source maps a CVE?
Usually no. They are an information disclosure. They become urgent when they contain secrets or make a messy codebase trivial to audit for other bugs.
Can I keep maps for Sentry or similar?
Yes, if they are uploaded privately to the tracker and not served from the public origin. Do not also leave sourceMappingURL on the public script.
How does RoastMyOpsec treat maps?
The free path check looks for sourceMappingURL breadcrumbs and well-known sensitive files. It does not download your entire asset graph.

Sources

Related guides