Skip to content

fix: vite-plugin-vue-devtools loaded unconditionally in all builds #49

@t0kubetsu

Description

@t0kubetsu

Problem

vite.config.js includes vite-plugin-vue-devtools without checking the current mode:

plugins: [
  vue(),
  vueJsx(),
  vueDevTools(),   // ← always active
  tailwindcss(),
],

vite-plugin-vue-devtools injects a development inspector overlay into the page. Shipping it in a production build exposes internal component structure, store state, and routing information to end users.

Expected

Gate the plugin on the Vite mode:

import { defineConfig } from 'vite'

export default defineConfig(({ mode }) => ({
  plugins: [
    vue(),
    vueJsx(),
    mode === 'development' && vueDevTools(),
    tailwindcss(),
  ].filter(Boolean),
  // ...
}))

Impact

Production builds currently bundle and activate the Vue DevTools overlay, leaking application internals.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingsecurity

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions