Your source code published by accident
Source map files that hand anyone your original, readable code.
Where it shows up: Vite, Next.js and most bundlers
Last updated
What it is
Build tools compress your code for the browser and can also produce source maps: files that map it back to your original source. They're meant for debugging.
If they're deployed, anyone can download your original code, including comments, internal routes and logic you'd rather not publish.
How often we see it
We ran Shippable's static checks on about 1,460 public GitHub repos built with five AI tools (October 2026). Each figure is the share of that builder's repos where the check fired at least once. A dash means it wasn't among that builder's most common findings. Full method and breakdown: Which AI builder ships the safest apps?
What an attacker sees
Readable source makes every other weakness easier to find: hidden admin routes, unfinished features, and the exact checks your app does and doesn't make.
How to fix it
Paste this into your AI tool:
My production build is serving JavaScript source maps (.map files) publicly, which exposes my original source code. Disable source maps in production (Vite: build.sourcemap: false; Next.js: productionBrowserSourceMaps: false), or make sure .map files are excluded from the deployed output, then redeploy.
Or by hand:
- Turn source maps off for production builds. In Vite set build.sourcemap to false; Next.js keeps them off unless productionBrowserSourceMaps is on.
- If you need them for error tracking, upload them privately to that service instead.
- Redeploy and re-scan.
Check your app
Shippable looks at the JavaScript files your site already serves and checks whether their source maps can be downloaded.
This check depends on your host, so scan your deployed app:
Or scan your live app in the browser: