Do your scripts point to a source map?
This check notes when one of your scripts names a source map, in a response header or a comment at the end of the file. It is a hint that readable source may be one request away.
What does this check look at?
It looks at whether a script names a source map in a response header or a trailing comment. Next.js, for example, turns browser source maps off in production builds unless you opt in.
Pulse and Deep scans both run it. It applies only when the development signals analyser is on, as it is by default.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Info finding | A script names a source map. | Confirm whether you mean to publish maps. |
A reference does not show the map can be downloaded or that it holds private code. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.
Fix it with your AI
Either keep publishing maps on purpose, or remove the reference and the files together.
One of my production scripts references a source map. Check whether my build publishes .map files on purpose. If it should not, turn source maps off for production builds or switch to hidden source maps uploaded privately to my error tracker, and make sure no sourceMappingURL comment or SourceMap header points to a missing or private map. Show me the config change.How to check
Say Atlas, our example app at atlas.example, ends each script with a source map comment. A Pulse notes the reference, and a Deep scan checks whether the map can be downloaded.
The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.
Questions people ask
Is this the same as an exposed source map?
No. This only sees the reference. The public source map check, in Deep scans, downloads the map and reads what it holds.
Will removing maps hurt my error reports?
Not if you upload them privately to your error tracker, which can still turn stack traces back into readable code.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- productionBrowserSourceMaps Next.js docs, read on October 7, 2026