# Can anyone download readable source code for your site?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The public source map check reads source maps a Deep scan can download, which can reveal file names and original code. Here is when that matters.

The public source map check reads source maps for your scripts when a Deep scan can download them. A map can reveal your original file names, comments and source code.

## What does this check look at?

It looks at whether source maps for your scripts can be downloaded and reveal source file names or source code. The secret key check also reads the maps it downloads, since keys sometimes hide in original source. Next.js, for example, turns browser source maps off in production builds unless you opt in.

Only a Deep scan runs it, after you prove you own the site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | A valid map was downloaded and lists source files or contents. | Decide whether maps should be public, and keep secrets out of browser code either way. |

Publishing maps can be deliberate, so availability alone does not show a security flaw. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |
| CWE | `CWE-540` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

If your error tracker needs maps, upload them to it privately instead of serving them to everyone.

:::fix-prompt any
Stop my production build from publishing browser source maps, unless I tell you they must stay public. Check my build config (for example productionBrowserSourceMaps in next.config, build.sourcemap in vite.config) and my hosting output for .map files. If I use an error tracker such as Sentry, set it up to upload maps privately during the build and delete them from the deployed output. Show me the config change.
:::

## How to check

Say Atlas, our example app at `atlas.example`, ships maps for every script. A Deep scan downloads them, lists the original file names and checks them for keys.

Deep scans come with the Deep plan, and [pricing](/pricing) shows what it includes. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Are public source maps a vulnerability?

Not by themselves. Plenty of open source sites publish them. They matter when the source holds secrets or logic you would rather keep private.

### Why does only Deep download maps?

A Pulse reads a couple of scripts and notes when they point to a map. Deep has the budget to fetch and parse the maps themselves.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [productionBrowserSourceMaps](https://nextjs.org/docs/app/api-reference/config/next-config-js/productionBrowserSourceMaps), Next.js docs, read on 2026-10-07