The started template will include sourcemaps containing eval() statements to the production build when used as shipped in this module. I think disabling sourcemaps using devtool: false would make more sense as the default in the webpack config. If someone needs devtools, they can enable it intentionally.
The main reason for this aside the fact that production builds shouldn't contain sourcemaps is, that builds containing such sourcemaps with eval() statements break ckeditor5 on sites sending a Content Security Policy header.
Content Security Policy header containing unsafe-inline in the valueResult: ckeditor5 breaks.
Add devtool: false to the webpack config of the starter template.
Needs review
1.0
Code
Btw. would be nice to have some style loader in the shipped webpack config too, but that's probably another issue of its own.