Public source map
*.js.map next to production bundles, or sourcesContent embedded in the map. Webpack / Vite / Next leave these on more often than people think.
Tags: js, recon, secrets
Typical severity: P4-P5
What it becomes
Almost never paid alone. It is how you find hidden endpoints, feature flags, and the real sinks.
Where to look
/_next/static//static/js/cdn target-assetsS3 buckets of frontend builds
Chains
- Hidden API / IDOR: Original source names the internal GraphQL mutations and admin routes the minified bundle hid.
- Secret: Maps sometimes contain .env leftovers, comments with tokens, or staging URLs.
Notes
- Use a mapper (sourcemapper, or browser devtools) and hunt like you have the repo.
- Do not report 'source map exposed' unless the program explicitly wants it or a secret is inside.