{"record":{"id":"91293eabb1a2b0bd","repo":"remix-run/react-router","slug":"source-maps-are-enabled-in-production-this-mak","errorCode":null,"errorMessage":"⚠️  Source maps are enabled in production\nThis makes your server code publicly\nvisible in the browser. This is highly\ndiscouraged! If you insist, ensure that\nyou are using environment variables for\nsecrets and not hard-coding them in\nyour source code.","messagePattern":"⚠️  Source maps are enabled in production\nThis makes your server code publicly\nvisible in the browser\\. This is highly\ndiscouraged! If you insist, ensure that\nyou are using environment variables for\nsecrets and not hard-coding them in\nyour source code\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/react-router-dev/vite/plugins/warn-on-client-source-maps.ts","lineNumber":29,"sourceCode":"    name: \"react-router:warn-on-client-source-maps\",\n    config(_, configEnv) {\n      viteCommand = configEnv.command;\n    },\n    configResolved(config) {\n      viteConfig = config;\n    },\n    buildStart() {\n      invariant(viteConfig);\n\n      if (\n        !logged &&\n        viteCommand === \"build\" &&\n        viteConfig.mode === \"production\" &&\n        !viteConfig.build.ssr &&\n        (viteConfig.build.sourcemap ||\n          viteConfig.environments?.client?.build.sourcemap)\n      ) {\n        viteConfig.logger.warn(\n          colors.yellow(\n            \"\\n\" +\n              colors.bold(\"  ⚠️  Source maps are enabled in production\\n\") +\n              [\n                \"This makes your server code publicly\",\n                \"visible in the browser. This is highly\",\n                \"discouraged! If you insist, ensure that\",\n                \"you are using environment variables for\",\n                \"secrets and not hard-coding them in\",\n                \"your source code.\",\n              ]\n                .map((line) => \"     \" + line)\n                .join(\"\\n\") +\n              \"\\n\",\n          ),\n        );\n        logged = true;\n      }","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/remix-run/react-router/blob/6beaca39526d5716c3c112ebb0782765baa5a9ce/packages/react-router-dev/vite/plugins/warn-on-client-source-maps.ts#L11-L47","documentation":"The warn-on-client-source-maps Vite plugin fires on `vite build` when mode is production, the build is not the SSR build, and client sourcemaps are on (`build.sourcemap` or `environments.client.build.sourcemap` truthy). Client .map files are uploaded with your static assets, making your server/component source publicly retrievable from the browser — including any secrets hard-coded in that source. The build succeeds; this is a security advisory.","triggerScenarios":"`react-router build` (or vite build in production mode) with `build.sourcemap: true` (or 'inline'/'hidden') set globally or on the client environment in vite.config.ts.","commonSituations":"Enabling `sourcemap: true` globally to feed an error-tracking service without scoping it to the server build; copying a dev-oriented vite config into production; CI adding sourcemaps for debuggability.","solutions":["Scope sourcemaps to the server only: set `environments.client.build.sourcemap: false`, or make `build.sourcemap` conditional on mode/config","If you need client maps for error tracking, prefer hidden/upload-on-build flows that delete maps from public output — but note any truthy client value still triggers this warning","If you deliberately ship client maps, audit the bundle source for hard-coded secrets and move them to environment variables; treat the warning as accepted risk"],"exampleFix":"// before - vite.config.ts\nexport default defineConfig({\n  build: { sourcemap: true },\n  plugins: [reactRouter()],\n});\n\n// after\nexport default defineConfig({\n  build: { sourcemap: process.env.NODE_ENV !== \"production\" },\n  environments: { client: { build: { sourcemap: false } } },\n  plugins: [reactRouter()],\n});","handlingStrategy":"validation","validationCode":"// assert client sourcemaps are off before a production build\nimport { defineConfig, resolveConfig } from \"vite\";\nlet resolved = await resolveConfig(defineConfig({}), \"build\");\nlet clientSourcemap =\n  resolved.build.sourcemap || resolved.environments?.client?.build?.sourcemap;\nif (resolved.mode === \"production\" && clientSourcemap) {\n  throw new Error(\"Disable client sourcemaps for production builds (environments.client.build.sourcemap: false)\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Scope `sourcemap` to the server environment only in vite.config.ts","Make production and dev config differ explicitly (mode-conditional) instead of one global sourcemap switch","Add a CI check on the built output: fail if *.map files exist in public/build (client) — also catches 'hidden' leaks"],"tags":["sourcemaps","security","production","vite","client-build"],"backgroundTag":"sourcemaps-in-production","analyzedSha":"6beaca39526d5716c3c112ebb0782765baa5a9ce","analyzedAt":"2026-08-18T18:04:14.938Z","contentChangedAt":"2026-08-18T18:04:14.938Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}