From f8d593a2366decb9e60b941431b3067efc9576c1 Mon Sep 17 00:00:00 2001 From: Matthew Valancy Date: Thu, 18 Jun 2026 20:04:47 -0700 Subject: [PATCH] SEC: disable production source maps (no public .js.map on the live site) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The live red-team probe caught /assets/index-*.js.map served 200 on production — public source maps leak the original source. vite build had sourcemap:true; set it to false. Dev (Vite dev server with its own maps) is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/web/vite.config.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/web/vite.config.ts b/packages/web/vite.config.ts index aeef2a04..a9b5862b 100644 --- a/packages/web/vite.config.ts +++ b/packages/web/vite.config.ts @@ -63,7 +63,10 @@ export default defineConfig({ }, build: { outDir: 'dist', - sourcemap: true, + // No production source maps — serving .js.map publicly leaks original source. + // Caught by the live red-team (REDTEAM-SEC). Dev uses the Vite dev server + // (its own maps), so debugging is unaffected. + sourcemap: false, rollupOptions: { output: { // Force new filenames to break cache