docs: add security hint

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: bneumann97

guides/hosting/configurations/shopware/environment-variables.md

@@ -30,7 +30,7 @@ This page lists all environment variables that can be used to configure Shopware
 | `ENABLE_OPENSEARCH_FOR_ADMIN_API`        | (empty)                   | When set to `1`, applies OpenSearch globally for supported Admin API searches and listings in Administration. Requires `ADMIN_OPENSEARCH_URL` and `SHOPWARE_ADMIN_ES_ENABLED=1` to be configured. Experimental feature (since 6.7.9.0)                                                                                                                                               |
 | `ENABLE_SERVICES`                        | `auto`                    | Determines if services are enabled, auto detects that based on `APP_ENV`, other possible values are `true` (or `1`) and `false` (or `0`). When set to `0`, Shopware Services won't be installed on the system                                                                                                                                                                        |
 | `FASTLY_API_KEY`                         | (empty)                   | API key for Fastly CDN integration. **Keep this value secure and do not commit it to version control.**                                                                                                                                                                                                                                                                              |
-| `GENERATE_SOURCEMAPS`                    | (empty)                   | Set to `true` to emit JavaScript sourcemaps during production builds (`NODE_ENV=production`). Applies to the Storefront webpack build and all Vite builds (Administration core, Administration extension plugins, and Storefront components). Has no effect in non-production environments, where sourcemaps are always generated. (since 6.7.13.0)                                    |
+| `GENERATE_SOURCEMAPS`                    | (empty)                   | Set to `true` to emit JavaScript sourcemaps during production builds (`NODE_ENV=production`). Applies to the Storefront webpack build and all Vite builds (Administration core, Administration extension plugins, and Storefront components). Has no effect in non-production environments, where sourcemaps are always generated. **Security note:** sourcemaps may expose source code; enable only in trusted environments or configure your web server/CDN to not serve `*.map` files. (since 6.7.13.0) |
 | `INSTANCE_ID`                            | (empty)                   | Unique Identifier for the Store: Can be generated with `openssl rand -hex 32`                                                                                                                                                                                                                                                                                                        |
 | `LOCK_DSN`                               | `flock`                   | DSN for Symfony locking                                                                                                                                                                                                                                                                                                                                                              |
 | `MAILER_DSN`                             | `null://localhost`        | Mailer DSN (Admin Configuration overwrites this)                                                                                                                                                                                                                                                                                                                                     |