diagnostic · one of 29Pro breakdown
Source maps
Is my source code exposed in production?
A source map shipped to production hands back the original code, the folder structure it was organised in, and sometimes the absolute path of the machine that built it. Most of the time it is an unchanged default rather than a decision, and nothing in the browser mentions it.
Reach itPress ⌘+K on any tab and type source maps.Ctrl+Kon Windows and Linux
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome buildin the panel · this one is Pro
What this actually is
bundles serving a map, and what they exposeBefore a launch, and on any site inherited from somebody else. It is worth being clear that a served map is not automatically a vulnerability: plenty of teams ship them deliberately so error reports are readable. The point is to know which of the two you are doing.
Asked about this diagnostic
3 of themAre source maps in production actually a problem?
They are a decision rather than a bug. Plenty of teams ship them on purpose so their error reporting is readable. The finding is that they are readable by everybody, and whether that is acceptable is yours to say.
Does it download my source?
It reads the map’s index of paths, not the file contents behind them, and nothing it reads leaves your browser.
It says the reference exists but the map is missing.
That is the healthy state: the comment is harmless on its own, and the file it points at is not being served. The row is kept so you can see the comment is there if you would rather strip it too.
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build63 of these · no host permissions · three free audits