# Is your live site serving a development build?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This check flags pages that load a script or library build meant for development. Here is why it slips through and how to ship the production build.

This check flags a page that loads a script or library build meant for development, such as a dev server client or a development copy of a framework. Live sites should serve the production build.

## What does this check look at?

It looks at whether a page loads a script or library build meant for development rather than production. It usually means the deploy ran the dev command or copied the wrong folder.

Pulse and Deep scans both run it. It applies only when the development signals analyser is on, as it is by default.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Low finding | A development asset is declared on the page. | Fix the deploy so it builds and serves production output. |

The development asset is never run, so no access to a development server is shown. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on a pattern in your content. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | Public deployments should serve the intended production artifacts |
| What is reached | A declared development client or library artifact |
| What follows | Extra debug code or development behavior; no access is demonstrated |

## Which standards does it relate to?

No OWASP, CWE or ASVS reference fits this check closely enough to state, so the report and this page leave it unmapped.

## Fix it with your AI

The fix is almost always in the build or start command your host runs.

:::fix-prompt any
My live site loads a development build asset: [paste the evidence from the report]. Check my hosting build settings and package.json scripts. Make sure the host runs the production build command (for example npm run build) and serves its output with the production start command, not the dev server. Remove any development-only client script from the HTML. Show me the settings to change.
:::

## How to check

Say Atlas, our example app at `atlas.example`, was deployed by running its dev server on a small cloud machine. The check sees the dev client script in the homepage and flags it.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is a development build dangerous?

It is slower and can expose extra debugging behaviour. The check does not show access to a development server, only that a development asset is served.

### How did this happen if my site looks normal?

Development builds look the same to visitors. They are bigger, slower and include tools meant only for your own machine.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07