# Source Map Exposure

> Identifies exposed JavaScript source maps via .map files, revealing original source code, file structure, and comments unintended for production.

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/source-map-exposure
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-04-01
- **Updated:** 2026-05-15

JavaScript source maps are generated during the build process to map compiled, minified bundles back to their original source files. When accidentally deployed to production, they disclose the full original source code of the application: including internal architecture, business logic, hardcoded strings, API endpoints, and developer comments. This is a deployment misconfiguration, but the impact is equivalent to a full source code disclosure. The Claude Code incident in 2025 is a documented real-world example where a publicly accessible `.map` file exposed the full TypeScript source of the application.

- **sourceMappingURL detection** checks deployed JS bundles for the trailing reference comment.
- **Map file download** fetches the .map JSON and inspects sourcesContent for embedded original source.
- **sourcemapper reconstruction** downloads the map and rebuilds the full directory structure locally.
- **Credential and secret grep** searches extracted source for API keys, tokens, passwords, and internal URLs.
- **nuclei automated detection** uses exposure and js tags to flag accessible map files at scale.

## What Source Maps Contain

A `.map` file is JSON. The critical field is `sourcesContent`: it embeds the complete original source of every file that contributed to the bundle:

```json
{
  "version": 3,
  "sources": ["../../src/auth/login.ts", "../../src/api/client.ts"],
  "sourcesContent": [
    "// Full original TypeScript source...",
    "// Full original TypeScript source..."
  ],
  "mappings": "AAAA,SAAS..."
}
```

Downloading a single `.map` file can expose hundreds of original source files at once, complete with file paths that reveal the internal project structure.

## Detect Source Map References in JavaScript

Build tools append a `sourceMappingURL` comment to the end of each bundle. Check deployed JS files for this reference first:

```bash
curl -sk https://$DOMAIN/static/js/main.chunk.js | tail -3
# // ... minified code ...
# //# sourceMappingURL=main.chunk.js.map
```

```bash
curl -sk https://$DOMAIN/static/js/main.chunk.js.map | python3 -m json.tool | head -20
# {
#   "version": 3,
#   "sources": [
#     "../../src/auth/login.ts",
#     "../../src/api/client.ts",
#     "../../src/utils/crypto.ts"
#   ],
#   "sourcesContent": ["import React...", "const API_KEY = 'sk-prod-...'"]
```

## Discover All JS Files and Check Each

Crawl all JavaScript files served by the application and check each for a sourceMappingURL comment:

```bash
curl -sk https://$DOMAIN/ | grep -oE '/[^"]+\.js' | sort -u
# /static/js/main.chunk.js
# /static/js/runtime-main.js
# /static/js/2.chunk.js
```

```bash
for jsfile in /static/js/main.chunk.js /static/js/runtime-main.js /static/js/2.chunk.js; do
  mapref=$(curl -sk https://$DOMAIN$jsfile | grep -o 'sourceMappingURL=.*')
  [ -n "$mapref" ] && echo "$jsfile -> $mapref"
done
# /static/js/main.chunk.js -> sourceMappingURL=main.chunk.js.map
# /static/js/2.chunk.js -> sourceMappingURL=2.chunk.js.map
```

## Common Map File Locations

Try predictable paths when no explicit reference is found:

```bash
for path in /static/js/main.js.map /static/js/bundle.js.map /assets/app.js.map /js/app.min.js.map /dist/main.js.map /build/static/js/main.chunk.js.map; do
  code=$(curl -skI https://$DOMAIN$path | grep HTTP | awk '{print $2}')
  echo "$code $path"
done
# 404 /static/js/main.js.map
# 200 /static/js/bundle.js.map
# 404 /assets/app.js.map
```

## Automated Detection with nuclei

```bash
nuclei -u https://$DOMAIN/ -tags exposure,js -severity info,low,medium
# [js-source-map] [info] https://example.com/static/js/main.chunk.js.map
```

## Extract and Reconstruct Source with sourcemapper

sourcemapper is the most practical tool for pentest use: it downloads the map file and reconstructs the full directory structure locally, exactly as it existed in the original codebase:

```bash
git clone https://github.com/denandz/sourcemapper && cd sourcemapper && go build
```

```bash
./sourcemapper -url https://$DOMAIN/static/js/main.chunk.js.map -output /tmp/sourcemap_dump/
# [+] Fetching source map from https://example.com/static/js/main.chunk.js.map
# [+] Extracting 47 source files
# [+] Writing src/auth/login.ts
# [+] Writing src/api/client.ts
# [+] Writing src/config/constants.ts
# [+] Done
```

The output directory contains the full reconstructed source tree. Browse it like a normal codebase. For multiple map files, run sourcemapper once per map URL.

## Alternative: unwebpack-sourcemap

```bash
pipx install unwebpack-sourcemap
unwebpack_sourcemap https://$DOMAIN/static/js/main.chunk.js.map /tmp/sourcemap_dump/
```

## Search Extracted Source for Sensitive Content

After reconstruction, grep the source files for credentials, keys, internal endpoints, and developer notes:

```bash
grep -rn -iE '(api_key|apikey|secret|password|token|auth)[[:space:]]*[=:][[:space:]]*["'"'"'][^"'"'"']{8,}' /tmp/sourcemap_dump/
# src/config/constants.ts:3:const API_KEY = 'sk-prod-xK2aB1cD3eF4gH5i';
```

```bash
grep -rn -iE 'TODO|FIXME|HACK|internal|admin|debug|bypass' /tmp/sourcemap_dump/ | head -20
# src/auth/login.ts:47:// TODO: remove debug bypass before prod
# src/api/client.ts:12:// internal admin endpoint - not exposed in frontend
# src/utils/crypto.ts:8:// FIXME: rotate this key
```

```bash
grep -rn -iE 'https?://[a-z0-9.-]+\.(internal|local|corp|intranet)' /tmp/sourcemap_dump/
# src/api/client.ts:5:const BASE_URL = 'https://api.internal.company.com/v2';
```

Internal API endpoints discovered in source code feed directly into [API endpoint enumeration](https://hackindex.io/services/web/enumeration/api-endpoint-enumeration): these paths often exist but are not linked from the frontend. Developer comments about bypasses, disabled checks, and TODO items are immediate vulnerability research targets.

## Format Reconstructed Code

Extracted source is sometimes unformatted. Run prettier for readability before reviewing:

```bash
npx prettier --write '/tmp/sourcemap_dump/**/*.{ts,js,tsx,jsx}' 2>/dev/null
```

## References

- [sourcemapper](https://github.com/denandz/sourcemapper) - Go tool for fetching and reconstructing source from exposed map files
- [MDN: Source Maps](https://developer.mozilla.org/en-US/docs/Tools/Debugger/How_to/Use_a_source_map) - Source map format and sourcesContent field documentation
- [Webpack: devtool](https://webpack.js.org/configuration/devtool/) - Build configuration for controlling source map generation in production