No source maps served

What this means

Passing means none of the first-party JavaScript your home page loads points at a source map we can fetch. Failing means a bundle ends with a //# sourceMappingURL comment and the .map file it names is served, or the bundle URL with .map appended returns a map. A reachable map gives anyone the original source your build compiled away.

How we test it

We parse the home page, fetch each first-party script it references, and look for a //# sourceMappingURL comment at the end of the bundle. We then request the map it names and also the bundle URL plus .map. A 404 on every map passes. A map that is referenced but returns 404 warns, since the comment still tells a reader where to look. A map that returns 200 fails.

Why it matters

Source maps hand over the original code, comments and often keys. The compiled bundle is hard to read; the map restores file names, function names, every comment your AI left in, and any constant that was inlined at build time, which is how keys end up public. The kit's security check for this module requests /_next/static/chunks/main.js.map on a Next.js site and expects a 404.

The fix

Turn off source map output for production builds in your framework's build configuration, or keep the .map files out of the deployed output, so the bundle carries no sourceMappingURL comment and the map path returns 404. Confirm with curl -s -o /dev/null -w '%{http_code}\n' https://YOUR_DOMAIN/_next/static/chunks/main.js.map on Next.js (expected 404), or the same request against your bundle URL plus .map on any other build. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE '<script[^>]+src="[^"]+"' and show me the first-party script URLs.
For each one, run: curl -s SCRIPT_URL | tail -c 300 | grep -o 'sourceMappingURL=[^ ]*' and show me what it prints.
For each one, run: curl -s -o /dev/null -w '%{http_code}\n' SCRIPT_URL.map and show me the status.
Open the build configuration and tell me whether production source maps are switched on, quoting the setting if there is one.
List what it would take to stop maps being served, and stop there.
Run: curl -s -o /dev/null -w '%{http_code}\n' https://YOUR_DOMAIN/_next/static/chunks/main.js.map and show me the output. Expected on a passing site: 404.