Source maps in production

A source map with sourcesContent reconstructs your original code from the minified bundle: comments, variable names, internal API routes, admin paths, feature flags, and any logic you assumed nobody would read.

Without sourcesContent it still reveals your folder and file structure, which tells someone how the app is organised.

Vite: build.sourcemap: false. Next.js: leave productionBrowserSourceMaps off. Create React App or craco: GENERATE_SOURCEMAP=false.

Then request any .map URL on your live site and confirm it 404s. Some hosts serve files from a previous build for a while.

Upload them to your error tracker at build time and exclude them from the deployed output. Sentry and similar tools all support this, and it gives you readable stack traces without publishing your code.