Source maps are not publicly accessible in production

Public source maps let anyone reconstruct your original pre-minified TypeScript or JavaScript from your production bundle — including business logic, API endpoint structure, internal variable names, comments, and any secrets that were inadvertently bundled. An attacker with your source maps can read your application as if they had access to your repository. CWE-540 (Inclusion of Sensitive Information in Source Code) and CWE-538 (File and Directory Information Exposure) both apply. OWASP A05 (Security Misconfiguration) lists public source maps as a common developer oversight. Next.js defaults to productionBrowserSourceMaps: false — enabling them is an explicit action that is easy to forget to revert after debugging.

Verify productionBrowserSourceMaps is absent or explicitly false in next.config.js. The default is already false — this check fails only when it's been explicitly enabled.

// next.config.js
const nextConfig = {
  // Do NOT set productionBrowserSourceMaps: true
  // productionBrowserSourceMaps: false  // explicit, but redundant
}

If you need source maps for error tracking (Sentry, Datadog), use the hidden-source-map webpack devtool or upload maps to your error tracking service via their CLI/CI integration without serving them publicly. Remove any .map files from the public/ or static/ directories if they were committed accidentally.