Source maps are development files that link minified or bundled JavaScript back to the original source code. They let developers debug production builds by showing readable variable names, file paths, and line numbers instead of compressed code.
In cyber security, publicly exposed source maps can leak internal logic that attackers would rather keep hidden. They may reveal API endpoints, authentication flows, feature flags, error handling, or other implementation details that help an intruder understand how a web application works. In phishing or malware campaigns, exposed source maps can also expose script behavior, command-and-control references, or browser checks that would otherwise be obscured in minified code. Defenders look for these files during web audits because removing or restricting them reduces accidental information disclosure and makes reconnaissance harder. Even when source maps are not directly exploitable, they can give attackers a useful head start.