Bun Bug #28001
- Entity ID:
ent-20260419-a0b1c2d3e4f5 - Type:
issue - Scope:
shared - Status:
active - Aliases: oven-sh/bun#28001, source-map-production-bug, bun-sourcemap-leak-bug
Description
GitHub issue filed against oven-sh/bun on March 11, 2026 (20 days before the Claude Code leak) documenting that Bun generates source maps in production mode even when its own configuration documentation states they should be disabled. Still open at the time Claude Code v2.1.88 shipped on March 31, 2026. Identified as the upstream runtime root cause of the source map leak: Claude Code's build pipeline assumed Bun honored its own sourcemap: 'none' / production defaults, but the bundler emitted .map files anyway. Ironic because Anthropic acquired Bun in late 2024 — the company shipped a known-open bug in its own acquired runtime and was exposed by it.
Key claims
- Claude Code was leaked by Anthropic's own acquired runtime
- Two-factor failure: either defense alone would have prevented the leak
Relations
- Source Map Leak (March 31, 2026) --[caused]--> Bun Bug #28001
- Bun Bug #28001 --[contained_in]--> Bun Runtime