VNX-540: Inclusion of Sensitive Information in Source Code

Detects production front-end builds configured to publish source maps (webpack devtool, Vue productionSourceMap, Vite build.sourcemap, Next.js productionBrowserSourceMaps, Angular production sourceMap, GENERATE_SOURCEMAP=true), which serve the original source to every visitor.

Field	Value
Rule ID	`VNX-540`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript
CWE	CWE-540
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`source-maps` `source-code-exposure` `cwe-540`
Source	`internal/sast/rules/vnx-540.rego`

Overview

VNX-540 maps to CWE-540: Inclusion of Sensitive Information in Source Code. A public source map turns a minified bundle back into the original source, with its comments, internal API routes, feature flags and any value an author left in it. This rule reports build configurations that publish one for production:

webpack devtool set to a source-map variant that embeds or links the source ('source-map', 'inline-source-map', 'eval-source-map', 'cheap-module-source-map'…) in a config whose mode is 'production' or whose file name says prod;
devtool: isProduction ? 'source-map' : ... where the production branch publishes maps;
Vue CLI productionSourceMap: true;
Vite build.sourcemap: true or 'inline';
Next.js productionBrowserSourceMaps: true;
an angular.json production configuration with "sourceMap": true;
GENERATE_SOURCEMAP=true in .env.production.

What Gets Flagged

// webpack.prod.js - FLAGGED
module.exports = merge(common, {
  mode: 'production',
  devtool: 'source-map',
});

// vue.config.js - FLAGGED
module.exports = { productionSourceMap: true };

What Is Not Flagged

hidden-source-map and nosources-source-map (no link in the bundle, or no source in the map), and devtool: false.
Development configs, Vite sourcemap: 'hidden', CSS dev source maps and values computed at run time.
Comments and string literals.

Secrets written directly into source code are reported by the secrets rules, not here.

Remediation

Turn public source maps off for production builds. If you need them for error reporting, generate hidden maps (devtool: 'hidden-source-map', sourcemap: 'hidden') and upload them privately to the error tracker instead of deploying them.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-540
// nosec vnx-540

Or record an ignore rule: vulnetix ignore add --rule vnx-540 --reason "...". See Suppressing findings.