Should you ship source maps to production?
Source maps (.map files) translate your minified JavaScript back into the original source. Great for debugging; less great when anyone can download them and read your code, comments and internal API routes.
Check
Open one of your JavaScript files in the browser and scroll to the bottom. If it ends with //# sourceMappingURL=something.js.map, try loading that URL. If it downloads, your source is public.
Turn them off
// vite.config.js
export default { build: { sourcemap: false } } // or 'hidden'// next.config.js (false is the default)
module.exports = { productionBrowserSourceMaps: false }If you use an error tracker, upload source maps to it privately during your build instead of serving them publicly.