Sourcemap Detector

Detects sourcemap leaks on websites. Shows a badge count and lets you view, copy, and export all detected sourcemap links.

Sourcemap Detector shows when a website exposes its sourcemaps. Sourcemaps are the files that map minified JavaScript and CSS back to the original source code, often including the full source. What it detects - SourceMap and X-SourceMap response headers on scripts and stylesheets - //# sourceMappingURL= comments in JavaScript and /*# sourceMappingURL= */ comments in CSS, including chunks loaded lazily after the page loads - The same comments in inline <script> and <style> blocks, including inline (data URI) sourcemaps Checks whether each map is really exposed Every referenced map is fetched and validated, so you can tell real leaks from dead references: - Exposed: a valid sourcemap, with the number of source files and whether it includes the original code - HTTP 404, 403 and other errors: referenced but not downloadable - Not a sourcemap: the URL responds, but with something else, such as a soft 404 page - Redirects are never followed, and maps on localhost or private network addresses are not fetched from public pages Popup - The toolbar badge shows the number of exposed maps (red), or the number of references when none are confirmed (grey) - Results are grouped by domain, with the site's own domain first - Click a domain to skip it, for example third-party tags or analytics scripts. Skipped domains are left out of Copy All and Export on every site - "Only exposed" limits Copy All and Export to maps that are confirmed downloadable - Export saves a text file with each map's URL, source and status Privacy To read file contents, the extension downloads each script and stylesheet a second time, plus every sourcemap they reference. These requests are sent without cookies. It collects no data, has no analytics and sends nothing to any server other than the sites you visit. Your settings are stored locally in your browser. Intended for developers checking their own sites and for security researchers. Only test sites you are authorized to assess.