Common problem

Are your source maps public?

Source maps link your built JavaScript back to your original code. If they're public, anyone can rebuild your source code, comments and file names.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How it happens

The production build is set to create source maps, and the host serves them next to your scripts.

What our scan checks

  • We look for the source maps your scripts point to and check if a few of them open.
Example fix prompt

Fix prompt from a full report

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
Turn off public source maps in my production build.
- Vite: set build.sourcemap to false (or 'hidden').
- Next.js: make sure productionBrowserSourceMaps is false.
- If I need maps for error tracking, upload them to my error tool (like Sentry) and don't serve them publicly.

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.