rea risk

very high

very high
high
moderate
baseline

A tool like rea can take your original source or your secret values as they are.

Leaks found: 1 kind (critical 1)

Target: dist (output folders picked by name, next to package.json)
Files read: 3

What to do next

1 map file(s) can be taken out for you: answer y in the terminal, or run npx reaproof fix. They are kept in a backup, and npx reaproof undo puts them back.

Fix the findings above from the top: the most damaging come first.
Then rebuild and run npx reaproof again. A finding that is gone is fixed.
After deploying, check the live site too: npx reaproof https://your-site

Leaks 1

CRITICAL

Your original source code is public

1 source map file(s) contain the full text of 4 original file(s).

Anyone who downloads them reads the code exactly as you wrote it.

The list: 1

dist/index.js.map (originals: ../../../src/pricing.ts, ../../../src/license.ts, ../../../src/client.ts, ../../../src/index.ts)

Fix: reaproof fix (takes the map files out of the output; can be undone)

To keep them from coming back on the next build:

Turn off production source maps in your build tool settings.
If an error tracker needs the maps, upload them there and then delete them from the output.

Good to know 1

NOTE

Server addresses that read straight from the code

1 server address(es) are in the code as they are. They cannot be hidden.

For each one, check that it is safe to call without signing in and never returns another user’s data.

The list: 1

https://api.shop-lab.test/v2

What cannot be hidden

Screen structure and the server addresses you call cannot be hidden once they reach a user device.
Compute anything that must not be copied, such as pricing or permission checks, on a server.
To see what is actually readable in the JavaScript, run reaproof measure.