Source maps are published next to the app code

Source maps are on by default in development and a build setting away from being published. An agent optimising for a working deploy has no reason to turn them off, and nothing in your app looks different when they ship, so they sit there handing out your file names and comments.

Anyone can rebuild your original files, including comments, file names, and any logic you assumed was hidden.

https://example.com/assets/index-4f2a.js.map returned 200, 1.2 MB

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Turn off source map output for production builds, or stop uploading the .map files. Seen at {map_url} for {bundle}.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Observed

  5,600 vibe-coded apps scanned

  More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

  2026-02

  Read the incident

This page is the explanation of the finding. The free tool runs the same check on your own app and returns the evidence line.

Source map exposure check

• source map
• fingerprint
• evidence