Guides / public source maps

Public source maps: your original code is readable by anyone

Production .map files let anyone read your original, unminified frontend code. How to check and turn them off in Vite and Next.js.

What it is

Source maps (.js.map files) translate minified JavaScript back into your original code, with comments and file names. Great for debugging, but if they are public, anyone can read your frontend source and find hidden endpoints, logic and sometimes keys. Vite does not generate them for production unless build.sourcemap is turned on, and Next.js keeps them off unless productionBrowserSourceMaps is enabled, but AI tools sometimes switch them on.

How to check

1. Open a JS file on your live site and look for a //# sourceMappingURL= comment at the end, then try opening that .map URL.
2. Check vite.config for build.sourcemap and next.config for productionBrowserSourceMaps.
3. Or run a free Cobalt Owl scan.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My production build publishes .map source map files. Turn off public source maps for production (build.sourcemap = false in vite.config, or productionBrowserSourceMaps: false in next.config), or upload them only to my error tracker instead of the public site. Then rebuild and confirm no .map files are deployed.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Vite: build.sourcemap
• Next.js: productionBrowserSourceMaps

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.