Your files stay on your device

# Source map exposure checker

Check whether a site's deployed bundles expose reachable source maps and whether those maps carry original source.

Fetch a page or paste its markup to check the deployed bundles.

A map reference and an exposed map are different findings. A comment pointing at a 404 is untidy but not a leak; a map that answers is a leak when it carries sourcesContent, because that is the original unminified source with comments. The remediation, in order of preference: stop deploying .map files, strip the sourceMappingURL comment too (a comment alone still tells attackers the maps existed), or upload maps to your error monitor at build time instead of the web server. This check is markup- and fetch-level only: scripts a tag manager injects at runtime are invisible, and nothing is executed.
Options

## More web & auth tools

- [Subresource integrity](/web/sri)
- [CSP evaluator & builder](/web/csp)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/javascript-source-map-exposure-checker
Markdown version: https://nutter.tools/web/javascript-source-map-exposure-checker.md
Plain-text version: https://nutter.tools/web/javascript-source-map-exposure-checker.txt
Agent index: https://nutter.tools/llms.txt