Free tool
Source Map Checker
Bundlers can ship .map files that reconstruct your original source — comments, internal URLs, sometimes secrets. If they're publicly reachable, so is your app's blueprint. This checks in seconds.
What this checks
- ✓Source map publicly accessible Art. 32 GDPR
How the check works
We load your production page, find the bundles it references and check whether their .map files are publicly reachable. If they are, anyone can rebuild your original source. Passive, read-only, nothing stored.
Common questions
Why are exposed source maps a problem?
A source map hands an attacker your app's original code — structure, comments, internal endpoints and occasionally hardcoded keys. Combined with a leaked secret it turns a finding into an incident (Art. 32 GDPR).
Aren't source maps useful?
Yes — for debugging and your error-tracking vendor. The fix isn't to stop generating them, but to stop serving them publicly.
How do I fix it?
Disable source-map upload in your production build (one flag in most bundlers) or restrict the .map files to your error-tracking vendor rather than shipping them to every visitor.
All free tools · every check explained · run the full 15-point check