# Do your scripts point to a source map?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This check notes when a script names a source map in a header or trailing comment. The reference alone does not show the map is public.

This check notes when one of your scripts names a source map, in a response header or a comment at the end of the file. It is a hint that readable source may be one request away.

## What does this check look at?

It looks at whether a script names a source map in a response header or a trailing comment. Next.js, for example, turns browser source maps off in production builds unless you opt in.

Pulse and Deep scans both run it. It applies only when the development signals analyser is on, as it is by default.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | A script names a source map. | Confirm whether you mean to publish maps. |

A reference does not show the map can be downloaded or that it holds private code. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

No OWASP, CWE or ASVS reference fits this check closely enough to state, so the report and this page leave it unmapped.

## Fix it with your AI

Either keep publishing maps on purpose, or remove the reference and the files together.

:::fix-prompt any
One of my production scripts references a source map. Check whether my build publishes .map files on purpose. If it should not, turn source maps off for production builds or switch to hidden source maps uploaded privately to my error tracker, and make sure no sourceMappingURL comment or SourceMap header points to a missing or private map. Show me the config change.
:::

## How to check

Say Atlas, our example app at `atlas.example`, ends each script with a source map comment. A Pulse notes the reference, and a Deep scan checks whether the map can be downloaded.

The free [quick check](/check) covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains the difference.

## Questions people ask

### Is this the same as an exposed source map?

No. This only sees the reference. The public source map check, in Deep scans, downloads the map and reads what it holds.

### Will removing maps hurt my error reports?

Not if you upload them privately to your error tracker, which can still turn stack traces back into readable code.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [productionBrowserSourceMaps](https://nextjs.org/docs/app/api-reference/config/next-config-js/productionBrowserSourceMaps), Next.js docs, read on 2026-10-07