Source Map Exposure
NullFault checks whether production JavaScript exposes .map source maps that can turn minified code back into readable source or reveal embedded secrets.
What NullFault Checks
- Whether public assets link to .map source maps or include inline source maps.
- Whether exposed maps appear to include original source content or secret-like values.
- Whether the exposure changes severity based on what is actually visible, not just that a map exists.
Why It Matters
- Source maps can reconstruct readable code, including route names, comments, feature flags, and implementation details.
- If the original source includes secrets or private config, the impact can become critical.
- Even without secrets, readable source speeds up manual review by an attacker.
Common Causes
- Leaving production source maps enabled in the build config.
- Uploading maps for error monitoring but also serving them publicly.
- Framework defaults that emit .map files alongside bundles.
Check it yourself
In DevTools Network, load your site and look for .js.map files returning 200. If a map opens and shows your original source, it is publicly reachable.
Mitigation
- Disable public production source maps unless you intentionally serve them (for example productionBrowserSourceMaps in Next.js or build.sourcemap in Vite).
- Upload private maps to your error monitoring provider instead of serving them publicly.
- Remove secrets from source and rotate anything that appeared in a public map.
- Verify CDN and static-hosting rules after deployment, not only local build settings.
Reality check
Publishing source maps can be a deliberate transparency choice. NullFault weighs the content and context more than the file type alone.