Free tool
Is your source code published with your app?
A source map maps your minified bundle back to the code you wrote: variable names, comments, file structure, and anything you left in them. Shipping one to production hands a reader your codebase. We fetch your bundles and check whether the maps they point at are actually reachable.
What it actually does
Three steps, and none of them touch anything on the address you give it. Worth reading before you point a scanner at your own production site.
-
Step 1
Fetch the page
One GET to the address you give us. Read-only, and nothing on the site is changed.
-
Step 2
Find the map references
Bundles carry a comment naming the source map that belongs to them. We read those names rather than guessing at filenames.
-
Step 3
Check the maps resolve
Each named map is requested. A map that answers is a map anybody can fetch, which is the finding.
Read-only. Nothing is signed in to, submitted or changed on the address you enter. See the methodology for how each result is graded.
The rest of it
This is one check of 48.
Source maps are one finding. The full scan also reads your bundles for leaked credentials and probes for exposed .env, .git and debug surfaces.
Run the full free auditRun your first audit today
Start on the free plan, with enough searches to cover a city and enough audits to judge a shortlist. No card, and it does not expire.