Can someone copy my website's code?
They can read whatever your app sends to the browser, which is your frontend code in minified form. That is normal and true of every website. The bigger risk is source maps.
Source maps are files that turn that minified code back into your original, readable source, comments and all. Build tools generate them to help with debugging, and AI-built apps often ship them to production by accident. When they are public, someone can reconstruct your original code, and any secret you hard-coded into it, straight from the browser.
The fix is to stop serving source maps in production, usually a single build setting. You can check whether yours are exposed with a scan of the live app.
Check whether your source is downloadable
What it means
Your app is publicly serving 'source maps' — files that let anyone reconstruct your original, unminified code (and any secrets or logic inside it) straight from the browser.
Why AI tools cause it
Build tools generate source maps to help debugging, and AI-generated setups often ship them to production by accident.
How xlogs checks it
xlogs checks whether your live JavaScript bundles expose their .map files.
How to fix it
The goal: Production no longer serves .map source-map files publicly.
- Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the affected spot
- Redeploy
In my app (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Then verify: After you redeploy, xlogs re-checks and confirms the .map files are no longer public.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
Is it bad that people can see my minified JavaScript?
No. Minified frontend code is visible on every website and is not the concern. The concern is public source maps, which turn that minified code back into your original source. Turning off source maps in production closes that gap.