⚠️ Source maps are enabled in production This makes your se

Error message

⚠️  Source maps are enabled in production
This makes your server code publicly
visible in the browser. This is highly
discouraged! If you insist, ensure that
you are using environment variables for
secrets and not hard-coding them in
your source code.

What it means

The warn-on-client-source-maps Vite plugin fires on `vite build` when mode is production, the build is not the SSR build, and client sourcemaps are on (`build.sourcemap` or `environments.client.build.sourcemap` truthy). Client .map files are uploaded with your static assets, making your server/component source publicly retrievable from the browser — including any secrets hard-coded in that source. The build succeeds; this is a security advisory.

Source

Thrown at packages/react-router-dev/vite/plugins/warn-on-client-source-maps.ts:29

    name: "react-router:warn-on-client-source-maps",
    config(_, configEnv) {
      viteCommand = configEnv.command;
    },
    configResolved(config) {
      viteConfig = config;
    },
    buildStart() {
      invariant(viteConfig);

      if (
        !logged &&
        viteCommand === "build" &&
        viteConfig.mode === "production" &&
        !viteConfig.build.ssr &&
        (viteConfig.build.sourcemap ||
          viteConfig.environments?.client?.build.sourcemap)
      ) {
        viteConfig.logger.warn(
          colors.yellow(
            "\n" +
              colors.bold("  ⚠️  Source maps are enabled in production\n") +
              [
                "This makes your server code publicly",
                "visible in the browser. This is highly",
                "discouraged! If you insist, ensure that",
                "you are using environment variables for",
                "secrets and not hard-coding them in",
                "your source code.",
              ]
                .map((line) => "     " + line)
                .join("\n") +
              "\n",
          ),
        );
        logged = true;
      }

View on GitHub (pinned to 6beaca3952)

Solutions

Scope sourcemaps to the server only: set `environments.client.build.sourcemap: false`, or make `build.sourcemap` conditional on mode/config
If you need client maps for error tracking, prefer hidden/upload-on-build flows that delete maps from public output — but note any truthy client value still triggers this warning
If you deliberately ship client maps, audit the bundle source for hard-coded secrets and move them to environment variables; treat the warning as accepted risk

Example fix

// before - vite.config.ts
export default defineConfig({
  build: { sourcemap: true },
  plugins: [reactRouter()],
});

// after
export default defineConfig({
  build: { sourcemap: process.env.NODE_ENV !== "production" },
  environments: { client: { build: { sourcemap: false } } },
  plugins: [reactRouter()],
});

Defensive patterns

Strategy: validation

Validate before calling

// assert client sourcemaps are off before a production build
import { defineConfig, resolveConfig } from "vite";
let resolved = await resolveConfig(defineConfig({}), "build");
let clientSourcemap =
  resolved.build.sourcemap || resolved.environments?.client?.build?.sourcemap;
if (resolved.mode === "production" && clientSourcemap) {
  throw new Error("Disable client sourcemaps for production builds (environments.client.build.sourcemap: false)");
}

Prevention

Scope `sourcemap` to the server environment only in vite.config.ts
Make production and dev config differ explicitly (mode-conditional) instead of one global sourcemap switch
Add a CI check on the built output: fail if *.map files exist in public/build (client) — also catches 'hidden' leaks

When it happens

Trigger: `react-router build` (or vite build in production mode) with `build.sourcemap: true` (or 'inline'/'hidden') set globally or on the client environment in vite.config.ts.

Common situations: Enabling `sourcemap: true` globally to feed an error-tracking service without scoping it to the server build; copying a dev-oriented vite config into production; CI adding sourcemaps for debuggability.

Related errors

AI-assisted analysis of remix-run/react-router@6beaca3952 (2026-08-18). Data as JSON: /api/errors/91293eabb1a2b0bd. Report an issue: GitHub.