rea risk

baseline

Before the fix: ~~very high~~

very high
high
moderate
baseline

None of the leaks this tool looks for was found. Code structure, the text and values in it, and server addresses are still readable, as in any shipped app.

Leaks found: 1 kind (critical 1) → none

Target: dist (output folders picked by name, next to package.json)
Files read: 2

What to do next

To keep them from coming back on the next build:

Turn off production source maps in your build tool settings.
If an error tracker needs the maps, upload them there and then delete them from the output.

Run npx reaproof after every build before you ship. It exits with 1 when a critical or high leak appears, which can stop a release.
After deploying, check the live site too: npx reaproof https://your-site

What the fix did

Done: 1 taken out.
Kept at: /home/node/.reaproof/backups/shop-web-9e7dd8976d3e/2026-10-18T09-27-36-271Z
Undo: reaproof undo

Good to know 1

NOTE

Server addresses that read straight from the code

1 server address(es) are in the code as they are. They cannot be hidden.

For each one, check that it is safe to call without signing in and never returns another user’s data.

The list: 1

https://api.shop-lab.test/v2

What cannot be hidden

Screen structure and the server addresses you call cannot be hidden once they reach a user device.
Compute anything that must not be copied, such as pricing or permission checks, on a server.
To see what is actually readable in the JavaScript, run reaproof measure.