SOURCE MAP EXPOSURE CHECKER

What is source map exposure?

Production JavaScript is minified into something unreadable. A source map undoes that: a .map file that reconstructs your original files — component names, TypeScript types, comments, folder structure — from the shipped bundle. Browsers load it when DevTools is open so stack traces point at real lines.

When that file is served from your public web root, the reconstruction is available to everybody, not just your team. And the bundle tells them where it is: minifiers append a //# sourceMappingURL= comment naming the exact path.

The related failure is an exposed .git directory. If the deploy copies the project folder verbatim, /.git/ goes with it — and Git holds full history, so a reachable .git gives away every commit ever made, including the one where a key was added and the later one where it was removed.

Why this happens in AI-generated apps

AI coding tools — Lovable, Bolt, v0, Cursor, Replit — optimize for a working preview, not a hardened build. Development-mode settings carry into the deployed artifact: maps stay on because they were on while you were iterating, and nobody changed a build flag that was never surfaced in the chat.

Deploys make it worse. A drag-and-drop upload, an rsync of the project folder, or a container that copies the working tree all place .git, .DS_Store, editor backups, and full build output where a browser can reach them. Platform defaults that would have caught this are bypassed the moment someone deploys “the folder” instead of the build directory.

And the source itself is unusually revealing in AI-generated apps. Models leave explanatory comments, keep the endpoint list inline, name admin routes plainly, and write client-side permission checks that read like documentation for how to bypass them. See source maps and .git exposed for the full pattern, and OWASP Top 10 for AI-generated code for how it compounds with the other failure modes.

What the scanner checks

How it works

1. Load — we fetch your URL in a real headless browser and collect every script the page requested.
2. Follow — each sourceMappingURL is resolved and fetched; common map paths are probed even when unreferenced.
3. Probe — known exposure paths are requested directly, including .git internals and stray build artifacts.
4. Reconstruct and scan — recovered original files are inspected for secrets, internal URLs, and revealing comments.
5. Report — each finding names the reachable URL, what it exposes, and the build or host change that closes it.

What each exposure gives away

Common fixes

• Turn source map generation off for production builds, or keep generating them and upload them to your error-tracking provider instead of the web root — you keep readable stack traces without publishing your codebase.
• If maps must ship to the web root, put them behind an auth-required path or a host rule that denies *.map to unauthenticated requests. Deleting only the sourceMappingURL comment leaves the file reachable.
• Deploy the build output directory, never the project folder. Add .git, .env, .DS_Store, and backup patterns to .gitignore, .vercelignore, .dockerignore, and the equivalent for your host.
• Add a host rule that denies every path beginning with a dot. It closes .git, .env, and the next dotfile someone invents.
• Rotate every credential that appears in recovered source or Git history. Removing it in a later commit does not remove it from the objects an attacker already cloned.
• Treat internal URLs and admin routes found in the source as public knowledge and confirm each one enforces server-side authorization. Obscurity was never the control.
• Re-scan after each deploy. Build configuration drifts, and a single “let me debug production” change can turn maps back on.

Related tools and guides

• .env Exposure Checker — the same deploy mistake that ships .git usually ships .env.
• Token Leak Checker — finds the keys that recovered source makes obvious.
• CORS Misconfiguration Checker — test the endpoints your exposed source just revealed.
• JWT Security Checker — source often shows exactly how tokens are signed and stored.
• Package Hallucination Scanner — a readable dependency list is also a supply-chain target.
• Vibe Code Scanner — full security scan of a deployed AI-generated app.
• Source maps and .git exposed pattern — how the flaw is found and exploited in practice.
• Lovable Safety Guide — what Lovable ships insecure by default and how to fix it.
• Replit Safety Guide — common exposure patterns in Replit-deployed apps.