← BlogFix prompt3 min readUpdated 2026-08-03

Prompt: stop shipping source maps to production

Source maps turn your minified bundle back into commented source. Anyone can download them.

Source maps exist so you can debug minified code. Deployed publicly, they hand an attacker your original source: route names, auth logic, feature flags, and comments explaining what is unfinished.

Copy this into Cursor, Claude Code, Lovable or your builder
Stop publishing source maps from my production build.

1. Check whether source maps are currently generated and served in
   production, and tell me which URLs expose them.
2. Disable them for production builds:
   - Next.js: productionBrowserSourceMaps: false in next.config
   - Vite: build.sourcemap: false
   - Create React App: GENERATE_SOURCEMAP=false
3. If I use an error tracker (Sentry and similar), keep source maps but
   upload them privately to the tracker during the build and delete them
   from the deployed output — I want readable stack traces without
   publishing my source.
4. Confirm no .map files remain reachable in the deployed build.

Tell me which files were exposed before this change.

What your AI should do with it

  • Source maps off for production but error tracking still readable.
  • Confirmation that no .map file is reachable afterwards.

How to check it worked

Look for them yourself

  1. 1Open your live app, F12, Sources tab.
  2. 2If you can browse your original folder structure and read commented code, maps are deployed.
  3. 3Or append .map to any bundle URL — it should return 404.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free