Can anyone download readable source code for your site?
The public source map check reads source maps for your scripts when a Deep scan can download them. A map can reveal your original file names, comments and source code.
What does this check look at?
It looks at whether source maps for your scripts can be downloaded and reveal source file names or source code. The secret key check also reads the maps it downloads, since keys sometimes hide in original source. Next.js, for example, turns browser source maps off in production builds unless you opt in.
Only a Deep scan runs it, after you prove you own the site.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Info finding | A valid map was downloaded and lists source files or contents. | Decide whether maps should be public, and keep secrets out of browser code either way. |
Publishing maps can be deliberate, so availability alone does not show a security flaw. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-540 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
If your error tracker needs maps, upload them to it privately instead of serving them to everyone.
Stop my production build from publishing browser source maps, unless I tell you they must stay public. Check my build config (for example productionBrowserSourceMaps in next.config, build.sourcemap in vite.config) and my hosting output for .map files. If I use an error tracker such as Sentry, set it up to upload maps privately during the build and delete them from the deployed output. Show me the config change.How to check
Say Atlas, our example app at atlas.example, ships maps for every script. A Deep scan downloads them, lists the original file names and checks them for keys.
Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Are public source maps a vulnerability?
Not by themselves. Plenty of open source sites publish them. They matter when the source holds secrets or logic you would rather keep private.
Why does only Deep download maps?
A Pulse reads a couple of scripts and notes when they point to a map. Deep has the budget to fetch and parse the maps themselves.
Run this check on your site
Only a Deep scan runs this check, once you prove you own the site. Deep walks your whole site, the scripts it loads and your API surface.
Run a Deep scanSources
- How we rate findings Lockpick docs, read on October 7, 2026
- productionBrowserSourceMaps Next.js docs, read on October 7, 2026