Public source maps in production

Why it matters

Source maps give attackers your original, readable source code.

How to fix it

Disable production browser source maps (Next.js: productionBrowserSourceMaps: false; Vite: build.sourcemap: false or 'hidden').

How we test it

Passive — runs in the free check, looks only at what a browser can see.