No source maps served in production

Production source maps ship your un-minified source — original variable names, inline comments, file structure, sometimes hardcoded dev-only debug URLs — to anyone who opens browser devtools. That turns reverse-engineering your auth flow, rate-limit bypass logic, or feature-flag gating from a 4-hour exercise into a 4-minute read. AI coding tools commonly enable productionBrowserSourceMaps: true because a tutorial or error-monitoring setup guide told them to, without explaining that the maps should be uploaded to Sentry/Datadog out-of-band rather than served on the public CDN. The .map files aren't automatically linked from HTML, but their URLs are deterministic (/static/js/chunk.abc.js.map) and the browser fetches them automatically when devtools opens.

Set productionBrowserSourceMaps: false (or remove the line) in next.config.js. For Vite, set build: { sourcemap: false }. Upload maps to your error monitor via their CLI instead.

Deeper remediation guidance and cross-reference coverage for this check lives in the data-protection Pro audit — run that after applying this fix for a more exhaustive pass on the same topic.

• ID: project-snapshot.data-exposure.no-source-maps-in-prod
• Severity: low
• What to look for: Check the framework config for source map generation in production. Next.js: productionBrowserSourceMaps in next.config.*. Vite: build.sourcemap in vite.config.*. Webpack: devtool setting. Also look for .map files in public/, dist/, build/, or .next/static/.
• Pass criteria: Production source maps are explicitly disabled (or not enabled) in the build config.
• Fail criteria: Config explicitly enables production source maps (e.g., productionBrowserSourceMaps: true), or .map files exist in shippable directories.
• Skip (N/A) when: Project has no build step (purely static HTML/CSS). Quote the absence of a build config.
• Do NOT pass when: Source maps are uploaded to Sentry/error monitoring but ALSO served publicly — they should be uploaded out-of-band and excluded from the public bundle.
• Report even on pass: "Source maps disabled in production build (config: productionBrowserSourceMaps not set / false)."
• Detail on fail: "next.config.js sets productionBrowserSourceMaps: true; .js.map files would ship to production".
• Remediation: Set productionBrowserSourceMaps: false (or remove the line) in next.config.js. For Vite, set build: { sourcemap: false }. Upload maps to your error monitor via their CLI instead.