Sourcemaps in production build

[fantua]

Hi,

I have a question about sourcemaps. I noticed that after production build sourcemaps is also generated. Is it good practice in production mode, and also safely?

Maybe there is some ENV param to disable this?

[gaearon]

JavaScript is inherently “open” to the client because the client has to execute it. It is unwise to rely on minification for any security considerations. If you’re worried about some code being seen, you should not send it in the JS bundle in the first place.

However, you can safely delete the *.map files from the build output if you wish so. The browser will likely warn you, but this doesn’t affect users in any way.

Just keep in mind it’s not a good security measure.