All drills

doors/no-public-source-maps

Production JavaScript serves no source maps.

mediumofficial

Install

firedrill hub add doors/no-public-source-maps

Reads

config.domains, web.source_maps

Fix when it fails

Stop publishing .map files in production, or restrict them to internal networks.

Test cases

CaseExpected
cleanPASS
publicFAIL
nothing checkedN/A

Drill file

firedrill: v0
id: doors/no-public-source-maps
safeguard: "Production JavaScript serves no source maps."
severity: medium
for_each: config.domains
fetch:
  maps: { fact: web.source_maps, args: { domain: target.domain } }
pass_when:
  - maps.found.size() == 0
fix: "Stop publishing .map files in production, or restrict them to internal networks."