Your original source code is downloadable
Source maps are files that map your minified production code back to your original, readable source. They are great for debugging and dangerous in production, because when they are public, anyone can download your original code straight from the browser. Here is why it happens and how to fix it.
What it means
Your app is publicly serving 'source maps': files that let anyone read your original, unminified code, comments and internal logic included, straight from the browser.
Why AI tools cause it
Build tools generate source maps to help debugging, and AI-generated setups often ship them to production by accident.
How xlogs checks it
xlogs checks whether your live JavaScript bundles expose their .map files.
Check your own app for this
How to fix it
The goal: Production no longer serves .map source-map files publicly.
- Turn off source-map generation for production builds (or stop the host serving .map files). This affects the affected spot
- Redeploy
In my app (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files). This affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Then verify: After you redeploy, xlogs re-checks the .map files and reports whether any is still public.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
What can someone do with my source maps?
They can reconstruct your original, unminified code: your logic, your comments, and any secret you hard-coded into it. It turns your private frontend into an open book. A map that carries your source is graded medium: it exposes code, not data or credentials, unless a secret was hard-coded into that code.
How do I stop shipping source maps?
Turn off source-map generation for production builds, or stop your host from serving .map files. In most frameworks it is a single build setting. After you redeploy, re-scan to confirm the .map files are no longer public.