Source map exposure checker

A map reference and an exposed map are different findings. A comment pointing at a 404 is untidy but not a leak; a map that answers is a leak when it carries sourcesContent, because that is the original unminified source with comments. The remediation, in order of preference: stop deploying .map files, strip the sourceMappingURL comment too (a comment alone still tells attackers the maps existed), or upload maps to your error monitor at build time instead of the web server. This check is markup- and fetch-level only: scripts a tag manager injects at runtime are invisible, and nothing is executed.