> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly-preview.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Your Source Maps Should Be Public

> Source maps are critical for web development in today's JavaScript environment.

> For the complete documentation index, see [llms.txt](/llms.txt). For the full documentation snapshot, see [llms-full.txt](/llms-full.txt).

<p class="publishedDate">
  <em>Published May 12, 2023</em>
</p>

<img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/63cb9d63fa778fd6ff2f88359ad557fea8b27d2a295983e2ffc79e6547d08e1d/assets/images/authors/chris-esplin.png" alt="portrait of Chris Esplin." class="authorAvatar" />

<p class="authorName">
  by Chris Esplin
</p>

Source maps are critical for web development in today's JavaScript environment.

In fact, all of our build tools—Rollup, Vite, WebPack, ESBuild—transpile and bundle our JavaScript and support source maps out of the box.

Debugging errors in production with transpiled code is nigh impossible. So our tooling creates source maps.

See [What are source maps? by Jecelyn Yeen](https://web.dev/source-maps/) for all of the details.

# Why private source maps?

Private source maps make it harder for an attacker to understand your front-end application.

An attacker can easily use public source maps to view the code in its original, un-transpiled state. The same source maps that make debugging easier make attacking your application easier.

Check out our unobfuscated source code on `https://www.highlight.io`! It's readable, public and easy to ingest for developer tools like LaunchDarkly. Our `vite` bundler generates these source maps with a [single flag](https://vitejs.dev/config/build-options.html#build-sourcemap).

<Frame caption="Unobfuscated source code on LaunchDarkly visible in the browser with public source maps.">
  ![Unobfuscated source code on LaunchDarkly visible in the browser with public source maps.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/87ffc81e093612fd1ac23f0ebb839a4158e1e1e5e209c25f224e6d047b821dbf/assets/images/tutorials/make-source-maps-public/unobfuscated-source-code.png)
</Frame>

## Why private source maps don't matter

Guess what!

With or without source maps, Chrome Dev Tools makes deconstructing your JavaScript application relatively easy.

For instance, You can open up the Network tab and watch each request and response.

<Frame caption="Chrome Dev Tools Network tab showing HTTP requests and responses.">
  ![Chrome Dev Tools Network tab showing HTTP requests and responses.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/df273199fcdcd82a8d1399674b09eb8145f6e48d29c8324ac3f3df0192a3807e/assets/images/tutorials/make-source-maps-public/network-tab.png)
</Frame>

The Application tab also surfaces the data your site is saving locally.

<Frame caption="Chrome Dev Tools Application tab displaying locally stored site data.">
  ![Chrome Dev Tools Application tab displaying locally stored site data.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/a67f051e29051356626efb81a2d11eae507624d8c05a6800edabbb86dd5ea265/assets/images/tutorials/make-source-maps-public/application-tab.png)
</Frame>

Who cares how the code is written if the results, in both data and network, are readily visible?

Dev Tools will even allow an attacker to reformat the code and use breakpoints to step through it!

And then there's ChatGPT...

### Chat

GPT as de-compiler

ChatGPT struggles with long code snippets, so it's not yet a silver bullet for decompilation.

<Frame caption="ChatGPT failing to decompile a long obfuscated code snippet.">
  ![ChatGPT failing to decompile a long obfuscated code snippet.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/554448a6a698c6143689b11ef9001a5cf3cedea72c48722d7791827d6f326835/assets/images/tutorials/make-source-maps-public/chat-gpt-fail.png)
</Frame>

But ChatGPT can de-compile shorter code snippets quite effectively.

<Frame caption="ChatGPT successfully decompiling a shorter obfuscated code snippet.">
  ![ChatGPT successfully decompiling a shorter obfuscated code snippet.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/59d8dc5e80925c21e51850c2bf2cedd473ab506f5a0c6bf7191e4ebf194e675e/assets/images/tutorials/make-source-maps-public/chat-gpt-success.png)
</Frame>

# Benefits of public source maps

## Debug with Dev Tools

Dev Tools will automatically recognize and apply public source maps to your code.

Debugging production issues will be much, much easier, especially if you see errors in your console. With public source maps, Dev Tools can link your errors directly to the de-compiled code. It's magical.

<Frame caption="Chrome Dev Tools debugger using public source maps to link errors to original code.">
  ![Chrome Dev Tools debugger using public source maps to link errors to original code.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/7897da7359ac9a8a058effa2681fa003cb136a4e9ac5bc762cb5d16b94f26abc/assets/images/tutorials/make-source-maps-public/dev-tools-debugger.png)
</Frame>

## Launch

Darkly automatically recognizes public source maps

LaunchDarkly does support private source maps. We even publish a [source map uploader](https://www.npmjs.com/package/@highlight-run/sourcemap-uploader) on NPM that will send your private source maps directly to our servers.

Our source map uploader works well, but depending on a team's setup, it can be tricky for users to implement and can become a constant source of bugs due to unique build pipelines and machine types.

However, if you make your source maps public, you don't have to do any of that work. And you automatically get production source maps for your own debugging in Dev Tools.

It's a win/win.