productionBrowserSourceMaps: true
Part of the Preview deploy safety check · fix arrives as a guide
What it is
productionBrowserSourceMaps is enabled, so source maps are published with the production build.
Why it matters
Anyone can reconstruct your original source from the browser, including comments, internal module names, and the logic behind client-side checks. It removes the small obstacle minification provides.
What the flag does
// next.config.js
module.exports = {
productionBrowserSourceMaps: true, // ← ships your source to every visitor
};With it on, next build emits .map files beside the client bundles and serves them publicly. Anyone’s devtools — or a one-line script — reconstructs your original TypeScript: file structure, comments, TODOs, internal URLs, and whatever else lives in client code because someone assumed nobody would read the minified bundle.
Check whether you are shipping maps today
# find a bundle URL in the page source, then ask for its map
curl -sI https://example.com/_next/static/chunks/main-app-XXXX.js.map | head -1
# HTTP/2 200 ← maps are public
# HTTP/2 404 ← you are fineWhy it usually got turned on
Someone needed readable stack traces in production — a real need with a better answer. The flag also slows builds, since generating maps for every client chunk is real work; teams pay that cost on every deploy for a debugging convenience that has a private alternative.
Fix it manually
Delete the flag (the default is false), and give your error tracker the maps privately at build time — readable stack traces without publishing the source:
// next.config.js — Sentry example: maps uploaded at build, never served
const { withSentryConfig } = require('@sentry/nextjs');
module.exports = withSentryConfig(
{ /* your config — productionBrowserSourceMaps removed */ },
{ sourcemaps: { deleteSourcemapsAfterUpload: true } },
);How lumioguard fixes it
The scan flags the flag in your Next.js config and checks whether the deployed site actually serves .map files. The fix arrives as a guide — remove the flag, and if an error tracker is present in the repo, the exact upload configuration for it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.