Is your site publishing its source maps?
Whether the source map files that sit alongside your JavaScript and CSS can be downloaded from your site.
Why it matters
A source map turns your minified JavaScript back into readable code, often with comments, file names and internal names. Publishing it hands anyone a copy of your front-end source, which makes it much easier to find weaknesses and copy your work. Maps that include the full source text are the most revealing.
How a survey checks it
Passive check: part of every free survey.
We follow the source map reference in each same-site file we read, download the map and check that it really is one. We never keep the map's contents. Maps on other sites are never requested.
How to fix it
- Turn off production source maps in your build tool, or keep generating them but do not upload them to the public site.
- If you use an error tracking service, upload the maps to it privately instead of publishing them.
Prefer us to do it? Ask for a fix quote
Common questions
Are source maps a security risk on their own?
Not directly, but they make every other problem easier to find. Most production sites do not publish them.
Will removing them break anything?
No. Browsers only use source maps when someone opens the developer tools.