Vercel
Security & compliance
Releases
Source maps enabled without environment guard in bundler config
Part of the Preview deploy safety check · fix arrives as a guide
What it is
A bundler config enables source maps without checking the environment, so they are produced for every build.
Why it matters
The same exposure as publishing them deliberately, but arrived at by accident — the setting was added for local debugging and applies everywhere.
How to fix it
Guard the setting on the environment so maps are generated in development and uploaded-but-not-served in production.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.