Yes, I'm wondering if there's a way to keep the source maps private.

For what reason? It's not as if minifying your assets is a reliable form of security.

Exactly. Anyone determined enough can essentially reconstruct your non-minified code from the minified version.

"essentially reconstruct"? That's generous language. You have to somehow determine the use of all variables and functions and what proper names for them would be. Outside of DOM calls, the logic and application layer is close to incomprehensible. See also the javascript of any large webapp.

> You have to somehow determine the use of all variables and functions and what proper names for them would be.

True, but in the mean time you can amuse yourself with hilarious variable names:

http://media.admob.com/gmsg.js => http://paste.ubuntu.com/1205328/

Or you can be lucky enough to find unobfuscated versions anyway, regardless of source maps:

http://cdn.optimizely.com/js/673.js

.. well, it was working yesterday.

Milk, turnip, knife? That's funny. I might start coding like that by default.

I've seen the javascript of large webapps. That's why I said determined. You could reverse-engineer even the craziest logic if you wanted.

Not for the security of the application, but to protect intellectual property. It's much less tempting to "borrow" snippets of code when it's been minified.

There are two ways of associating a sourcemap with a file in the spec: 1) http header and 2) //@ sourceMappingURL comment in the destination file. You could expose the HTTP header only to to Rescue.js IPs, or alternatively they could conceivably provide an interface to make the map associations within the admin panel.

Ah. An interface in the admin panel sounds best, but that would probably add steps to a deployment process...