Production Source Maps: Risk and How to Disable Them
Updated 2026-10-17
Source maps translate minified bundles back to original files. Public maps with sourcesContent hand out your readable source code, comments, and internal endpoint names.
Disable public maps
Next.js leaves browser source maps off unless productionBrowserSourceMaps is enabled. In Vite, set build.sourcemap to false or 'hidden' (hidden emits maps without the reference comment so you can upload them privately).
// vite.config.ts
export default defineConfig({ build: { sourcemap: "hidden" } });
// next.config.ts
export default { productionBrowserSourceMaps: false };Keep debuggability
Upload maps to your error tracker during CI and delete them from the deploy directory.
Checklist
- *.js.map returns 404 in production
- Maps uploaded privately if needed
- No secrets in source comments
Copy-paste fix prompt
Disable public production source maps in my build config, add a CI step that uploads them to my error tracker and removes them from the output folder, and verify a sample .js.map URL returns 404.FAQ
Are source maps a vulnerability by themselves?
They are an information disclosure. Severity depends on what the code reveals — hard-coded secrets or hidden admin routes make it serious.
Does a missing map stop reverse engineering?
No, but it raises the effort and removes comments and original names.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan