CodePark/ questions / Secrets in frontend bundles
START PRACTICINGPRACTICE
Frontend question · Frontend security › Secrets in frontend bundles

Your production site serves its .map source map files publicly. What is the real security impact?

Attackers can read your original source and comments more easily. The bundle was public anyway, so the real danger is secrets or internal notes in that source

A source map links the minified code back to your original files. It gives an attacker readable code, but no new powers. The minified bundle was already public and readable with some effort. So minifying is not a security control. The risk is what the source contains: comments, internal URLs or secrets someone wrote in code. Many teams upload maps to their error tracker and don't serve them publicly.

"The maps contain the server's environment variables" is the tempting wrong answer. A map holds only what the client source held. Values like NEXT_PUBLIC_ ones are already in the bundle.