RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is eval safe if I validate the input first?

Validation that is strict enough to make eval safe is strict enough to replace eval with a parser. Remove eval instead.

What severity is code injection?

Critical. It gives the attacker code execution with the server process's permissions, which usually means the database, the secrets in the environment and the machine itself.

Türkçe

Code injection: request input passed to eval

eval runs whatever string it is given as code. When that string comes from a request, the person sending the request decides what your server executes.

Example

Vulnerable

app.post("/contributions", (req, res) => {
  const preTax = eval(req.body.preTax);
  const roth = eval(req.body.roth);
  save(preTax, roth);
});

Fixed

app.post("/contributions", (req, res) => {
  const preTax = Number.parseInt(req.body.preTax, 10);
  const roth = Number.parseInt(req.body.roth, 10);
  if (![preTax, roth].every(Number.isFinite)) return res.sendStatus(400);
  save(preTax, roth);
});

How it happens

Developers reach for eval to turn "42" into 42 or to evaluate a formula. But a value of require('child_process').execSync('id') is also valid JavaScript. The same applies to new Function, vm.runInNewContext, setTimeout with a string, and template engines asked to compile user-supplied template text. OWASP NodeGoat ships exactly this bug in its contributions form.

How to fix it

There is almost never a reason to evaluate request data.

Parse numbers with Number or parseInt and validate them
Use JSON.parse for structured data
For behaviour chosen by the user, dispatch through a table of allowed operations
Render fixed templates and pass user data only as variables

How RepoVerse finds it

CriticalRequest input is executed as code
Whoever sends the request chooses what JavaScript runs on the server, with the process's permissions — read files, reach the database, open a shell.
data flow · CWE-95
HighCode evaluated from a value
`eval`, `exec` or `new Function` is called on something that is not a literal.
pattern
HighRequest input chooses or compiles a template
Template engines evaluate expressions; user-controlled template text or view names can lead to code execution or file disclosure.
data flow · CWE-1336

Questions

Is eval safe if I validate the input first?: Validation that is strict enough to make eval safe is strict enough to replace eval with a parser. Remove eval instead.
What severity is code injection?: Critical. It gives the attacker code execution with the server process's permissions, which usually means the database, the secrets in the environment and the machine itself.

Updated 2026-10-11