JavaScript source maps may be publicly accessible

A source map is a file that maps a website's compressed, hard-to-read production JavaScript back to its original, readable source code, normally used by developers for debugging. This check looks for whether these .map files are publicly reachable on the live site. On this site, JavaScript source maps appear to be served publicly. A publicly accessible source map hands anyone who looks in their browser's developer tools, or simply downloads the .map file directly, the site's full original source code, its original variable and function names, internal file paths, and any comments developers left in the code. This makes it dramatically easier for someone to understand how the site's internals work and look for weaknesses to exploit. Your developer should stop deploying .map files to the public production build, or restrict access to them so only an authenticated error-tracking service, such as Sentry, can read them. For Vite or Webpack-based projects, this typically means setting the sourcemap build option to 'hidden' or uploading maps only to the private error-tracking service rather than the public bundle. About 30 minutes.