JavaScript Source Map Exposure Checker

Find out whether a site publishes the source maps its bundles reference, which would put original source and comments within reach of anyone.

Passive public check

a2z.tools reads publicly visible information from the address you enter. It is a read-only request - nothing is submitted, changed or probed.

Page address Reads first-party scripts and checks whether the maps they reference actually resolve.

A referenced map is not an exposed map

Minified JavaScript usually ends with a comment like //# sourceMappingURL=app.js.map. That comment is a reference. Whether the map is actually reachable is a separate question, and most tools conflate the two.

Plenty of builds leave the comment in and never deploy the .map file. The browser asks for it, gets a 404, and nothing is disclosed. That is untidy, not a finding. This tool reads the comment and then fetches the map to see whether it answers, and reports the two cases differently:

Exposed - the map resolves and parses. Something is genuinely reachable.
Referenced only - the comment exists, the map does not. Informational.
Inline - the map is embedded in the script as a data URL, so the source ships to every visitor inside the bundle. Almost always a development build reaching production.

What an exposed map actually gives away

Every source map discloses original file names and directory structure. That alone tells someone how the project is laid out, which framework conventions it follows, and often which internal modules exist.

A map containing sourcesContent discloses considerably more: the original source itself, before minification, with comments intact. This tool reports that case at a higher severity and says which maps have it, because the difference is substantial. Comments and internal endpoint names routinely reveal more than the code does.

This may well be deliberate

Publishing source maps is a legitimate and common choice - it is what makes production stack traces in error monitoring readable, and for a front end whose logic is not itself a secret the trade is reasonable. The tool says so rather than treating every exposed map as a mistake. The question to answer is whether it was a decision.

If it was not, stopping the deployment of .map files is only half the fix. Remove the sourceMappingURL comment as well - it is the thing that points at them, and leaving it means every visitor's browser requests a file that should not exist.

The middle path most teams want is uploading maps to the error monitoring service at build time and not deploying them to the web root. That keeps readable stack traces without publishing the source.

Scope and limits

Only first-party scripts referenced in the page HTML are checked, and a bounded number of them. Third-party scripts are skipped deliberately - their maps are their vendor's decision, not yours. Map contents are never stored or returned; the tool counts the source entries and reports whether sourcesContent is present, and nothing else.

This is a passive check on paths the page itself references. It does not guess at file names or probe for maps that are not pointed to.

Frequently asked questions

Is publishing source maps a vulnerability?

No. It is a disclosure, and frequently a deliberate one. It does not create a flaw; it removes effort from finding one, and it can leak comments and internal names. Decide whether it was intended.

Why does it say "referenced only"?

The sourceMappingURL comment is there but the map returns an error, so nothing is actually exposed. This is the common and harmless case - worth tidying so browsers stop requesting a missing file, but not a disclosure.

What is sourcesContent?

An optional field that embeds the original source files inside the map. With it, an exposed map hands over your pre-minification code with comments. Without it, only file names and structure are disclosed.

How do I keep readable stack traces without publishing maps?

Upload them to your error monitoring service at build time and exclude them from the deployed web root. Most monitoring tools support this directly.

Does this probe for map files I have not referenced?

No. It only follows sourceMappingURL comments that the scripts themselves contain. Guessing at paths would be enumeration, which these tools do not do.

References

Related tools

What this tool can and cannot tell you. It reports the configuration a site exposes to an ordinary visitor. It does not log in, submit anything, or test for vulnerabilities, so a passing result means the public configuration looked correct at the moment of the check - not that the site is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.