yarn build and the project contains the entire source code

I came across this accidently. In the past I was used to have an obfuscated version of my SPA after “npm run build”.

With the latest react-static (which does not work correctly with npm run build, but it passes with yarn build, see here https://github.com/nozzle/react-static/issues/1053) there is the full source code available in user’s browser. In the beginning I thought, this is just because there is somewhere a file link to the source code in a map or so and it would be only visible to me, but after deploying it to a webserver it was also available to all.

Steps to reproduce:

• react-static create
• use “blank” target
• To visualize the issue add a console.log("Hello World") in App.js, but you could also browse the source tree in developer console

render () {
    console.log("Hello World")
    return (

• run yarn build
• run `yarn serve``
• open localhost:3000 in your browser
• open developer console
• find Hello World and click the right most link to ‘App.js:9’

Find your sources. Bummer

I never had this with previous react-static versions.

[tannerlinsley]

We’ll have a config option for this sourceMaps: true and possibly some other options. This option will likely default to false, given that most people don’t need source maps in production.

Yes, you could easily just not upload them, but I think that would provide more trouble for people who repeatedly have to remove them or exclude them from the build directory, etc. While that’s still possible, I think the flag will be more intuitive for both use cases.

[neilyoung]

Right, feel free to close. I’m having my solutions