Your original source code is downloadable
Source maps are files that map your minified production code back to your original, readable source. They are great for debugging and dangerous in production, because when they are public, anyone can download your original code straight from the browser. Here is why it happens and how to fix it.
What it means
Your app is publicly serving 'source maps' — files that let anyone reconstruct your original, unminified code (and any secrets or logic inside it) straight from the browser.
Why AI tools cause it
Build tools generate source maps to help debugging, and AI-generated setups often ship them to production by accident.
How xlogs checks it
xlogs checks whether your live JavaScript bundles expose their .map files.
Check your own app for this
How to fix it
The goal: Production no longer serves .map source-map files publicly.
- Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the affected spot
- Redeploy
In my app (the spot the scan shows): your original source code is downloadable. Please make this true: Production no longer serves .map source-map files publicly. Steps: Turn off source-map generation for production builds (or stop the host serving .map files) — this affects the spot the scan shows; Redeploy. Then tell me exactly what you changed, and do not print any secret values back to me.
Then verify: After you redeploy, xlogs re-checks and confirms the .map files are no longer public.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
What can someone do with my source maps?
They can reconstruct your original, unminified code: your logic, your comments, and any secret you hard-coded into it. It turns your private frontend into an open book. That is why this is high severity when a map is genuinely public.
How do I stop shipping source maps?
Turn off source-map generation for production builds, or stop your host from serving .map files. In most frameworks it is a single build setting. After you redeploy, re-scan to confirm the .map files are no longer public.