Exposed Source Maps in Production Leak Application Source Code
What Is This Vulnerability?
Source maps are files that map minified production JavaScript back to the original source code. When these files are accessible in production, anyone can reconstruct your entire frontend codebase, including business logic, API endpoints, internal comments, and patterns that reveal how your application handles authentication and authorization.
Why It Happens
Build tools like Webpack, Vite, and Next.js generate source maps by default to aid debugging. Developers often forget to disable source map generation or restrict access to .map files before deploying to production. Some hosting configurations serve all static files without filtering by extension.
Example Code
const nextConfig = {
// Source maps are generated and publicly accessible
productionBrowserSourceMaps: true,
webpack(config) {
config.devtool = "source-map";
return config;
},
};
export default nextConfig;const nextConfig = {
productionBrowserSourceMaps: false,
webpack(config, { isServer }) {
if (!isServer) {
config.devtool = false;
}
return config;
},
};
export default nextConfig;How Hackers Exploit It
An attacker inspects your page, finds references to .js.map files in the minified bundles, and downloads them. Using a source map explorer, they reconstruct the original code. This reveals API endpoint structures, client-side validation logic, hidden admin routes, error handling patterns, and comments that may contain credentials or internal documentation.
How to Fix It
Disable browser source map generation in your production build configuration. In Next.js, set productionBrowserSourceMaps to false. If you need source maps for error monitoring (like Sentry), upload them directly to the monitoring service and do not serve them publicly. Add server rules to block requests for .map files.