Why it matters
Public source maps make it much easier for someone to read your app's logic, find hidden admin routes and spot hard-coded values. They are rarely the problem on their own, but they speed up every other attack.
How Patch checks
For each JavaScript bundle we look for a sourceMappingURL comment and try the .map file next to it. It counts if a real source map comes back.
How to fix it
- Turn off production source maps in your build (for Vite: build.sourcemap = false; for Next.js: productionBrowserSourceMaps = false).
- If you want them for error tracking, upload them to your error tracker privately instead of publishing them.
- Redeploy and check the affected URLs now returns 404.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.