Source maps in production without shipping the source

Minified stack traces are unreadable, and the usual fix — shipping source maps — publishes the original source to anyone who opens devtools. Both problems have the same solution and it is a configuration choice, not a trade-off.

// webpack.config.js
devtool: 'hidden-source-map',

// emits the .map file but adds no //# sourceMappingURL comment
// upload it to the error tracker, do not deploy it to the web root

hidden-source-map generates the map without the reference comment, so browsers never fetch it and an error tracker given the file can still symbolicate. eval-source-map is the fast one for development and must never reach production — it embeds the source in the bundle itself. Deploying the wrong devtool is a quiet way to publish a codebase.