RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Does a nonce make 'unsafe-inline' safe?

When a nonce or hash is present, CSP Level 2 browsers ignore 'unsafe-inline', so keeping it only helps very old browsers. RepoVerse does not report 'unsafe-inline' when a nonce or hash is in the policy.

Can I use CSP with Next.js or React?

Yes. Next.js supports nonces through middleware, and React renders without inline scripts by default. Third-party tags are usually what make a strict policy hard.

Türkçe

Content Security Policy: writing one that actually protects

A Content-Security-Policy tells the browser which scripts it may run. Done well, an injected <script> simply does not execute. Done loosely, the header is there and protects nothing.

Example

Weak

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'

Strict

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; upgrade-insecure-requests

What weakens a CSP

'unsafe-inline' in script-src allows exactly the inline scripts and event handlers an injection produces. 'unsafe-eval' lets strings become code. Sources such as *, https: or data: allow script from any host. A policy with no script-src or default-src does not restrict scripts at all, and a report-only policy blocks nothing. Missing object-src 'none' and base-uri leave two older bypasses open.

How to build one

Start strict in report-only mode, fix what it reports, then enforce.

Use a per-response nonce on your scripts, plus 'strict-dynamic' for the scripts they load
Add object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Move inline event handlers into script files
Send it as a header — frame-ancestors does not work in a meta tag

How RepoVerse finds it

ModerateNo Content-Security-Policy
If any page has an injection bug, the injected script runs with nothing to stop it — CSP is the layer that limits what one XSS can do.
website · CWE-693
LowContent-Security-Policy is only reported, not enforced
A report-only policy logs violations but blocks nothing, so it gives no protection yet.
website · CWE-693
ModerateCSP allows inline scripts
`'unsafe-inline'` in `script-src` lets injected `<script>` tags and event handlers run, which is the main thing a CSP is there to stop.
website · CWE-79
LowCSP allows eval
`'unsafe-eval'` lets strings become code through `eval`, `new Function` and string timers, which turns some injection bugs into script execution.
website · CWE-95
ModerateCSP lets scripts load from anywhere
A `script-src` of `*`, `https:`, `http:` or `data:` allows script from any host, so an attacker who can inject a tag can load their own file and the policy will allow it.
website · CWE-693
LowCSP leaves plugins or the base URL open
Without `object-src 'none'` old plugin content can still execute; without `base-uri` an injected `<base>` tag can redirect every relative script URL on the page.
website · CWE-693

Questions

Does a nonce make 'unsafe-inline' safe?: When a nonce or hash is present, CSP Level 2 browsers ignore 'unsafe-inline', so keeping it only helps very old browsers. RepoVerse does not report 'unsafe-inline' when a nonce or hash is in the policy.
Can I use CSP with Next.js or React?: Yes. Next.js supports nonces through middleware, and React renders without inline scripts by default. Third-party tags are usually what make a strict policy hard.

Updated 2026-10-11