high severity · fix guide
How to Stop Serving Source Maps in Production
Your app is publicly serving 'source maps' — files that let anyone reconstruct your original, unminified code (and any secrets or logic inside it) straight from the browser.
Why AI tools cause it
Build tools generate source maps to help debugging, and AI-generated setups often ship them to production by accident.
The goal
Production no longer serves .map source-map files publicly.
The steps
- Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows
- Redeploy
Fix it with your AI coding tool
Pick your tool and paste the instruction. It is written to make the goal above true, and to never print any secret values back to you.
Paste this to Any AI tool:
In my app (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Lovable:
In my Lovable app (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Cursor:
In my codebase (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Claude Code:
In my codebase (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Do it myself:
Goal: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy.
Then verify it worked
After you redeploy, xlogs re-checks and confirms the .map files are no longer public.
Check your app for this issue
Free, read-only. Confirm the issue is present, then re-scan to prove your fix worked.