Security guides
Source Map Exposure

Source Map Exposure

NullFault checks whether production JavaScript exposes .map source maps that can turn minified code back into readable source or reveal embedded secrets.

What NullFault Checks

  • Whether public assets link to .map source maps or include inline source maps.
  • Whether exposed maps appear to include original source content or secret-like values.
  • Whether the exposure changes severity based on what is actually visible, not just that a map exists.

Why It Matters

  • Source maps can reconstruct readable code, including route names, comments, feature flags, and implementation details.
  • If the original source includes secrets or private config, the impact can become critical.
  • Even without secrets, readable source speeds up manual review by an attacker.

Common Causes

  • Leaving production source maps enabled in the build config.
  • Uploading maps for error monitoring but also serving them publicly.
  • Framework defaults that emit .map files alongside bundles.

Check it yourself

In DevTools Network, load your site and look for .js.map files returning 200. If a map opens and shows your original source, it is publicly reachable.

Mitigation

  • Disable public production source maps unless you intentionally serve them (for example productionBrowserSourceMaps in Next.js or build.sourcemap in Vite).
  • Upload private maps to your error monitoring provider instead of serving them publicly.
  • Remove secrets from source and rotate anything that appeared in a public map.
  • Verify CDN and static-hosting rules after deployment, not only local build settings.

Reality check

Publishing source maps can be a deliberate transparency choice. NullFault weighs the content and context more than the file type alone.

Related guides