A source map is a debugging file that links minified, bundled, or transpiled JavaScript back to the original source code. It helps developers trace errors, set breakpoints, and read meaningful file names and line numbers after a production build has been compressed for delivery.
In cyber security, source maps matter because they can reveal more than debug context. If exposed publicly, they may disclose source paths, internal module names, function logic, feature flags, comments, or even code fragments that make an application easier to reverse-engineer. Attackers use that information to locate weak endpoints, understand authentication flows, and spot hidden secrets or implementation mistakes. Defenders often keep source maps private, disable them in public releases, or restrict access to authenticated error-reporting systems. Treat them as sensitive build artifacts, not harmless convenience files.