Security scorecard

kuber.studio

Score 77/100 · 4 failed · 1 warnings · 5 passed · 1 not applicable

Scanned 2026-10-22 12:16 UTC in 9.2s · 10 requests · 3 scripts

Top finding (free)

mediumConfirmedfailExposed artifacts

Public source maps expose original source code

Your production JavaScript declares source maps that are publicly downloadable. Anyone can rebuild your original, unminified app code, including comments, internal API routes and business logic.

Confirmed with a small ranged request to 1 declared map file(s): HTTP 200/206 with a JSON source-map structure. ShipGuard did not download or store the maps.

Confirmed: HTTP 200 with file content validated (HTML soft-404 pages are rejected).

Locations

https://kuber.studio/static/js/main.7270b14e.js.map

Copy-paste fix prompt

@codebase Security fix.

My production build publishes JavaScript source maps. Disable public source maps for production (Next.js: `productionBrowserSourceMaps: false`; Vite: `build.sourcemap: false` or 'hidden'), upload maps privately to my error tracker instead if needed, redeploy, and confirm *.js.map URLs return 404.

Make the minimal change, show the diff per file before applying, and add a short note in SECURITY.md describing the fix.