Issue
I configured source maps to work in Sentry, but now the .map files are publicly available and I can see my source code in the browser's developer tools. I want to know whether the source maps have to stay public.
Applies To
All SaaS Customers and Self-Hosted Users
Source Maps
Resolution
No. Once you upload your source maps to Sentry, the files do not need to be publicly available, and Sentry recommends removing them from your production deployment.
If you use one of the Sentry bundler plugins, set the filesToDeleteAfterUpload option to delete the source maps after they upload. For example, with the webpack plugin:
sentryWebpackPlugin({
org: "<your-org-slug>",
project: "<your-project-slug>",
sourcemaps: {
assets: "./build/*",
// A glob (or array of globs) for build artifacts to delete
// after the upload to Sentry completes.
filesToDeleteAfterUpload: ["./build/**/*.map"],
},
// ...other settings
});
To also stop browsers from requesting the maps in the first place, generate hidden source maps so the bundler does not add a //# sourceMappingURL comment to your bundles. Set sourcemap: "hidden" (Vite/Rollup) or devtool: "hidden-source-map" (webpack). You can additionally configure your server to deny access to .js.map files.
If you use other tooling to upload source maps, manually delete the .map files before deploying to production.