Please report security issues privately through GitHub Security Advisories rather than as a public issue.

Expect an acknowledgement within 72 hours and an assessment within seven days.

The latest minor release receives security fixes. This project is pre-1.0.

unmapped reads a build directory and prints text. The following are in scope:

• Leaking what it was asked to find. This tool reports on embedded source code, so the one thing it must never do is reproduce that source in its own output. The JSON report carries byte counts rather than content, and a test asserts it. Any path by which scanned source reaches the report is a genuine finding.
• Code execution while scanning. Nothing in a scanned directory should ever be executed. Bundles are read as text and maps as JSON.
• Denial of service. A crafted map or directory tree that makes a scan hang or exhaust memory. Directory depth is bounded and only the first and last 8 KiB of each bundle are read.
• Report injection. Terminal escape sequences in a file path or a sources entry that rewrite the screen.
• Path traversal. A sourceMappingURL is resolved relative to its bundle; a construction that gets the tool to read outside the scanned directory is in scope.

• A wrong verdict. A missed broken map or a false alarm is a correctness bug and a genuinely useful report, but it is not a security issue.
• Source maps published by projects unmapped scans. That is the finding, not a vulnerability in this tool. Report it to whoever owns the deploy.

• No network access. It never fetches a remote sourceMappingURL and never contacts an error tracker.
• Nothing is executed. Bundles are read as text, maps as JSON.
• Read-only. unmapped never writes to the directory it scans.
• Zero runtime dependencies. Installing it does not widen your supply chain.
• No install script.
• Bounded reads. Only the head and tail of each bundle are read, and directory descent is capped at 24 levels.

examples/leaky-build deliberately contains a source map with embedded source. That "source" is four lines of invented pricing logic written for the fixture. It exists so the disclosure rules have something to detect, and so the test asserting the report does not echo source content has something to assert against.