Source maps in production: is your original code public?

Public source maps can expose your original code, including commented-out keys. How to check your site and turn them off in Vite, Next.js and CRA.

What a source map is

Your live app ships compressed, hard-to-read JavaScript. A source map (.map file) lets the browser rebuild your original, readable code, including comments and code you thought you deleted (howsafeismyapp). If someone once pasted a key into a comment, it can still be sitting in the map (SelfSec).

A source map is not a breach by itself. It is "a map to where your secrets would be" (reeve.page).

How common is it?

In an August 2026 scan of 30,998 vibe-coded apps, 13% served a source map. However, most of those were Base44's own badge script. For code the app's owner actually wrote, the rate was about 1 app in 40, ranging from 1% on Lovable to 6% at the high end (reeve.page).

30-second check

Open your site → DevTools → Sources. If you see a readable src/ folder with your component names, your maps are public.

How to turn them off

• Vite (Lovable, Bolt): in vite.config, remove build.sourcemap: true, or set it to false or 'hidden'. The default is off, so if maps are public, someone turned them on (howsafeismyapp).
• Next.js (v0, Cursor): make sure productionBrowserSourceMaps is not true in next.config.js (howsafeismyapp).
• Create React App: build with GENERATE_SOURCEMAP=false (howsafeismyapp).
• Using Sentry or similar? Use 'hidden' maps, upload them to the tracker during the build, then delete them from what you deploy (howsafeismyapp; SelfSec).

Then redeploy and repeat the 30-second check. If a key ever appeared in your code, rotate it, because turning maps off doesn't un-publish what was already out there.

Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist