RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Which secret formats does RepoVerse recognise?

Provider formats for AWS, GitHub, Stripe, Slack, OpenAI, Anthropic, SendGrid and Google service accounts, PEM private keys, connection strings with passwords, and high-entropy values assigned to secret-named variables. Placeholders and test fixtures are left out.

Can it find secrets in a live website?

Yes. The website review searches page HTML, the site's own scripts and published source maps for provider-format secret keys, and shows only the first characters of anything it finds.

Türkçe

Hardcoded secrets: API keys in code, commits and bundles

A key in source code is readable by everyone who can read the code — and for a public repository or a website bundle, that is everyone. Automated scrapers find new keys within minutes of a push.

Example

Vulnerable

// committed to the repository and shipped in the bundle
const stripe = new Stripe("sk_live_…");
const DB_PASSWORD = "Tr0ub4dor&3";

Fixed

// read from the environment on the server; rotate anything that was committed
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const DB_PASSWORD = process.env.DB_PASSWORD;
// the browser only ever sees publishable keys (pk_live_…)

How it happens

A key gets pasted in to make something work locally, a .env file is committed by accident, or a server-side secret is referenced from front-end code and ends up in the JavaScript bundle. Deleting the line later does not help: the value stays in git history and in every clone and cache.

How to fix it

Treat any committed secret as leaked.

Revoke and rotate the key in the provider's dashboard first
Read secrets from the environment or a secret manager on the server
Keep only publishable keys (Stripe pk_…, restricted browser keys) in front-end code
Add .env to .gitignore and scan before pushing

How RepoVerse finds it

HighCredential assigned as a literal
A password, secret, token or API key is assigned a literal string rather than read from configuration.
pattern
CriticalAWS access key id in the source
An `AKIA…` access key id is hard-coded.
pattern
CriticalGitHub token in the source
A GitHub personal access, OAuth or app token is hard-coded.
pattern
CriticalLive Stripe secret key in the source
An `sk_live_…` key is hard-coded.
pattern
CriticalOpenAI or Anthropic API key in the source
A model-provider key is hard-coded.
pattern · CWE-798
CriticalPrivate key committed to the repository
A PEM private key block is in the source.
pattern
HighLong random-looking value assigned to a credential
The name says credential and the value is dense and arbitrary — the shape of a real key rather than a placeholder.
pattern · CWE-798
CriticalEnvironment file committed to the repository
A `.env` carrying real values is in the repository, so every secret in it is readable by anyone who can clone — and remains so in the history after it is deleted.
pattern · CWE-538
CriticalSecret key visible in a public page or script
Anyone who opens the page source has the key and can use it with your account's permissions — these are scraped automatically.
website · CWE-798

Questions

Which secret formats does RepoVerse recognise?: Provider formats for AWS, GitHub, Stripe, Slack, OpenAI, Anthropic, SendGrid and Google service accounts, PEM private keys, connection strings with passwords, and high-entropy values assigned to secret-named variables. Placeholders and test fixtures are left out.
Can it find secrets in a live website?: Yes. The website review searches page HTML, the site's own scripts and published source maps for provider-format secret keys, and shows only the first characters of anything it finds.

Updated 2026-10-11