Source map exposure checker
Source maps turn your minified production code back into your original, readable source. Great for debugging, dangerous in production. This free checker tells you whether yours are public.
Run the check
Free, read-only, no signup. This runs a full xlogs scan and reports this issue plus anything else it finds.
What this checks
It looks at your live JavaScript bundles and checks whether their .map files are reachable, confirming the file is really a source map before flagging it. If they are public, anyone can reconstruct your original code, comments and any secret hard-coded into it.
Why it gets missed
Build tools generate source maps to help debugging, and AI-generated setups often ship them to production by accident. Turning them off for production builds is usually a single setting.
See the full step-by-step fix, with a copy-paste block for your AI tool →