Checks · SEC-007

SEC-007 · Source maps public in production

Why it matters

Public source maps hand your original source to anyone who loads the site.

How we detect it

A source map URL returns a real map file.

How we fix it

Turn off production source maps in the framework config.

Can it be fixed automatically? Yes, with a template change

Related checks

• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP
• HDR-003 · Clickjacking: no frame-ancestors or X-Frame-Options