Source map files (.map) are being included in CodePush releases due to Sentry instructions #5148

Description

At Revopush, we conducted an analysis and anonymously observed a significant number of bundles containing .map files inside CodePush releases.

This negatively affects both:

• Clients, who end up downloading unnecessary data
• Security, since .map files expose extended information

We discovered that .map files are included in CodePush releases because of the Sentry documentation, which suggests placing both the build and sourcemap into the same folder.

For example, the following command:

code-push-standalone release-react \
  "${APP_NAME}" \
  "${PLATFORM}" \
  --deploymentName "${DEPLOYMENT_NAME}" \
  --outputDir ./build \
  --sourcemapOutput ./build

For Android it is important to have CodePush as a root dir for --outputDir to support JTW signing

code-push-standalone release-react \
  "${APP_NAME}" \
  "${PLATFORM}" \
  --deploymentName "${DEPLOYMENT_NAME}" \
  --outputDir ./build/CodePush \
  --sourcemapOutput ./build

To avoid .map files being shipped in CodePush releases, the --sourcemapOutput path should point to a directory different from the build folder.

We’ve updated the instructions on our website: https://docs.revopush.org/cicd/sentry

We recommend updating the official instructions to prevent .map files from being unintentionally included in CodePush releases.