Guides / exposed-env-git-sourcemaps
Stop shipping .env, .git, and source maps to production
Deploy blockers that still show up on vibe-coded launches — and how to remove them quickly.
What to look for
/.envreachable over HTTPS — rotate every secret inside./.git/configpublic — can help attackers reconstruct your repo..js.mapfiles on production — expose original source.
Fixes
- Add
.envand.gitto.gitignoreand your host’s ignore/export settings. - Disable production source maps (e.g. Vite
build.sourcemap: false, NextproductionBrowserSourceMaps: false). - Redeploy and confirm those paths 404.
PreflightVibe checks these paths with read-only GET requests during the free/full launch check.
Run a free PreflightVibe launch check
Paste your live URL. Get an A–F grade. Unlock the full report for $29 when you are ready.
Free quick scan