Should I ship source maps to production, and how do I strip console logs?

No. Source maps expose your entire unminified source code to anyone who opens browser DevTools. Vite disables them by default, so the rule is simply: do not re-enable them for a production build.

The related leak is debug logging. Stray console.log statements in production quietly emit user IDs, API responses and internal state to anyone with the console open. Strip them at build time rather than trying to remember to remove them by hand:

// vite.config.ts
export default defineConfig({
  esbuild: {
    drop: ['debugger'],
    pure: ['console.log', 'console.info', 'console.debug', 'console.trace']
  }
});

Here is the trap, and it is a nasty one. Do not use drop: ['console']. It removes every console method - including console.error and console.warn. Your production app then silently swallows all errors: users hit a blank screen with zero feedback, and you get nothing in the console to diagnose it. It looks like a tidier config and it is actually a debugging blackout.

Use pure: [...] instead, and list the methods explicitly. It strips the debug noise while keeping console.error and console.warn alive for the errors you actually need to see.

Related, and the bigger sibling of this rule: anything in the bundle is public. Full item: https://www.tigzig.com/security/frontend.