Publicly accessible source maps
A source map (a .js.map file) links the minified JavaScript served to the browser back to the original source code — useful for debugging in production. If it's publicly accessible and contains sourcesContent, anyone can reconstruct your unminified code: business logic, comments, sometimes secrets that were lying around in the code before being removed.
How to spot it
Every minified JS file references its source map on the last line:
//# sourceMappingURL=app.js.mapIf that URL returns 200 and the content includes "sourcesContent", the full source code is exposed.
The fix
On Next.js, disable source maps in production:
// next.config.js
module.exports = {
productionBrowserSourceMaps: false, // already the default
};If you need them for error monitoring (Sentry and similar tools), generate them but don't serve them publicly — most of these tools support uploading source maps directly without going through a publicly accessible URL.
Check whether your site is affected by this vulnerability.
Scan my app