Yes, publicly served source maps can reveal your original file names and code structure, and they make it easy to see which packages are inside a bundle. Minification alone does not hide that. If you want debugging without exposure, generate maps but keep them off your public servers.
What a source map is
A bundler turns many source files into a few minified files. A source map is a separate file that maps positions in the minified output back to the original source, so browser tools and error trackers can show readable stack traces.
A bundle normally ends with a comment pointing to its map. If the map file is reachable, anyone can download it and read the mapping.
What exposure looks like
Depending on the tool and settings, a map can list the paths of every source file, including paths under node_modules. That tells a reader exactly which packages and folders went into your build. Some maps also embed full source text. Treat anything you publish in a map as published source.
This is not a vulnerability by itself. It is an information leak that lowers the effort for an attacker studying your app, and it can reveal internal paths or comments you did not mean to share. Check your own output rather than assuming.
Options in a common tool
The Vite documentation lists the sourcemap build option as false by default, with four modes:
| Setting | Result |
|---|---|
| false | No map generated (default) |
| true | Separate map file, with a comment in the bundle |
| inline | Map appended to the bundle as a data URI |
| hidden | Separate map file, with the comment suppressed |
Hidden is useful because your error tracker can still receive the map through a private upload, while visitors are not pointed to it. Note that hidden only removes the pointer comment. If the file sits on a public path, it can still be fetched by anyone who guesses the name, so also keep it off the public server.
A safe release routine
- Decide whether production needs maps at all. If not, leave them off.
- If you use an error tracker, generate hidden maps and upload them privately in CI.
- Delete map files from the folder you deploy.
- After a release, request a bundle URL plus the extension for the map in a test and confirm it returns not found.
- Use your build output to produce a dependency inventory so you know what is in each bundle.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how the inventory lists each package and version. A public source map can hand an outsider a similar list.
Quick check
Is a minified bundle enough to hide my code?
No. Minification shortens names and removes whitespace. With a reachable source map, readers can map it back to your original files.
What does the hidden sourcemap option do in Vite?
It generates a separate map file like the true option but suppresses the map comments in the bundled files.
Safeguard builds an SBOM and dependency inventory from your project, which helps you see which packages sit in your frontend. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
