Preventing Source Code Exposure: VS Code Copilot and Source Maps

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Correction note (2026-10-13). An earlier version of the rule in this article used NOT_CONTAINS as one word. The rule DSL spells it NOT CONTAINS (the field, then NOT, then the operator), so the rule did not load.

Describe the task

VS Code Copilot is debugging a production exception. To get better stack traces, it enables source maps in the TypeScript config:

{
  "compilerOptions": {
    "sourceMap": true
  }
}

SSG blocks the write — production source maps expose your original TypeScript source code and business logic to any user who opens browser DevTools.

# illustrative sample output
[BLOCK] write › tsconfig.json — rule: no-sourcemap-in-prod-config

Give SSG context

SSG evaluates VS Code Copilot's file write calls via the SSG MCP Server integration.

Required context

rule no-sourcemap-in-prod-config {
  enabled true
  priority 90
  severity error
  DENY write
  IF path MATCHES ".*(tsconfig|webpack\.config|vite\.config).*"
  AND content CONTAINS "sourceMap"
  AND content NOT CONTAINS "false"
  MESSAGE "Source maps enabled in build config. Production source maps expose your original source code. Use hidden-source-map or disable for production."
}

Optional context

Also block inline source maps in build tooling:

rule no-inline-sourcemap {
  enabled true
  priority 90
  severity error
  DENY write
  IF path MATCHES ".*(webpack|rollup|vite)\.config.*"
  AND content CONTAINS "inline-source-map"
  MESSAGE "Inline source maps embed your full source code in the bundle. Use 'false' for production."
}

What SSG does

SSG checks the config file content at write time. Source maps are never enabled in the production config — your source code stays obfuscated in the deployed bundle.

Ask the agent to use a dev-only config override

sourceMap in production config was blocked. Use environment-specific configs:

// tsconfig.dev.json — development only
{ "compilerOptions": { "sourceMap": true } }

// tsconfig.prod.json — production
{ "compilerOptions": { "sourceMap": false } }

// package.json build scripts
"build:dev":  "tsc -p tsconfig.dev.json",
"build:prod": "tsc -p tsconfig.prod.json",

For debugging production issues, use Sentry or Datadog with server-side source map upload instead.

Server-side source map upload (best practice)

Upload source maps to your error-tracking service, then delete them from deployments:

# Upload to Sentry (never ships to users)
sentry-cli releases files VERSION upload-sourcemaps ./dist --rewrite
# Delete from deploy artifact
find ./dist -name "*.map" -delete

This gives you full stack traces in error tracking without exposing source to users.