JavaScript source-map structure is publicly served
ShipReady found a source-map URL derived from a discovered script that returned a readable body with the supported source-map structure markers.
Why it matters
Published source maps can expose implementation detail that teams may prefer not to serve publicly.
How ShipReady detects it
What it inspects
ShipReady derives .map URLs from discovered script URLs on the fetched page and probes the capped derived list.
What triggers a finding
A finding requires a readable derived map response containing both supported version and sources structure markers.
What the evidence shows
A reported script-derived URL returned content matching ShipReady's bounded source-map structure check.
Limits of this check
ShipReady does not parse the map completely, reconstruct source, inspect every script on the site, or prove that the map contains secrets or sensitive code.
How to fix it
Choose a source-map publication policy
Determine whether browser-readable source maps are intentional for this deployment. If not, keep maps in private build artifacts or error-reporting tooling rather than the public static output.
Adjust the public build artifact
Update the build or hosting configuration so the reported script-derived .map URL does not serve the unintended map. This finding does not establish that the map contains source code or credentials.
How to verify the change
Recheck the script-derived map URL
After deployment, inspect the reported script and request its derived .map URL to confirm the previous source-map structure is no longer publicly served when that is the intended policy.
Expected: The reported derived URL has the intended source-map publication behavior.