School · Module 4 · Lesson 4 of 4
Don't leave debug or admin routes public
/admin, /api/test and source maps have no place on the production hostname.
Gate admin UIs behind real auth and, ideally, a separate hostname. Remove test and debug routes from production builds.
Turn off production browser source maps unless you have a strong reason and a private symbol server.
Search the built output for paths like /api/debug, /studio and __dev__ before each launch.