What it means

Your build ships .map files that reconstruct the original source code — including comments, internal URLs and sometimes secrets.

Why it matters

Source maps hand an attacker your app's blueprint. Combined with a hardcoded key it turns a finding into an incident (Art. 32 GDPR).

How to fix it

Disable source-map upload in your production build (one flag in most bundlers) or restrict the files to your error-tracking vendor.