Hi,

Yes — this is intentional and generally not considered a security issue on its own.

Many platforms (including GitHub) serve source maps in production to support:

• debugging in browser dev tools
• better error stack traces
• faster issue diagnosis

Source maps may expose things like:

• original file structure
• module names
• readable (unminified) code

But they are not supposed to include sensitive information. As long as no secrets (API keys, tokens, credentials, internal endpoints, etc.) are present, this is considered acceptable and common practice.

It only becomes a potential concern if:

• sensitive data is exposed in the source
• internal-only logic or endpoints are unintentionally revealed
• the source provides meaningful attack surface (e.g., security-critical implementation details)

In general, GitHub and similar platforms are aware of this trade-off and design their builds to avoid leaking anything sensitive, even with source maps enabled.

Bottom line:
Public source maps can look alarming, but by themselves they are not a vulnerability — only the content inside them would determine if there’s a real issue.