In Tomcat 5.5 onwards, there is a setting called "keepgenerated" that retains the generated .java files generated from the .jsp files, for debugging purposes. By default, this is set to true.

We should be overriding this our server.xml or web.xml to false, as source files living on production servers can be viewed as a security risk by some organisations.