Is your live site serving a development build?
This check flags a page that loads a script or library build meant for development, such as a dev server client or a development copy of a framework. Live sites should serve the production build.
What does this check look at?
It looks at whether a page loads a script or library build meant for development rather than production. It usually means the deploy ran the dev command or copied the wrong folder.
Pulse and Deep scans both run it. It applies only when the development signals analyser is on, as it is by default.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Low finding | A development asset is declared on the page. | Fix the deploy so it builds and serves production output. |
The development asset is never run, so no access to a development server is shown. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on a pattern in your content. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | Public deployments should serve the intended production artifacts |
| What is reached | A declared development client or library artifact |
| What follows | Extra debug code or development behavior; no access is demonstrated |
Fix it with your AI
The fix is almost always in the build or start command your host runs.
My live site loads a development build asset: [paste the evidence from the report]. Check my hosting build settings and package.json scripts. Make sure the host runs the production build command (for example npm run build) and serves its output with the production start command, not the dev server. Remove any development-only client script from the HTML. Show me the settings to change.How to check
Say Atlas, our example app at atlas.example, was deployed by running its dev server on a small cloud machine. The check sees the dev client script in the homepage and flags it.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Is a development build dangerous?
It is slower and can expose extra debugging behaviour. The check does not show access to a development server, only that a development asset is served.
How did this happen if my site looks normal?
Development builds look the same to visitors. They are bigger, slower and include tools meant only for your own machine.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026