RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

What HSTS max-age should I use?

At least 15552000 seconds (180 days); a year (31536000) is common. Start lower while testing, and add includeSubDomains only once every subdomain serves HTTPS.

Should I submit my site to the HSTS preload list?

Only when you are sure every subdomain will stay on HTTPS: preloading is hard to undo. Add the preload directive and submit at hstspreload.org once the policy has run without problems.

Türkçe

HTTPS and HSTS: closing the plain-HTTP gap

Having a certificate is not the same as being HTTPS-only. As long as the plain HTTP address answers, and the browser is not told to stop using it, the first request of a visit can be read and rewritten.

Example

Missing

HTTP/1.1 200 OK            ← http://example.com/ serves the page
                            (no redirect, no HSTS on the HTTPS version)

Fixed

HTTP/1.1 301 Moved Permanently
Location: https://example.com/

# on every HTTPS response:
Strict-Transport-Security: max-age=31536000; includeSubDomains

Where it leaks

A visitor typing example.com or following an old http:// link makes a cleartext request first. If that answers with content instead of a redirect, an attacker on the network can serve whatever they like. Even with a redirect, without HSTS that first hop is open to SSL stripping. On HTTPS pages, scripts or images loaded over http:// are blocked or can be swapped.

How to fix it

Three steps, in order.

Redirect every http:// request to https:// with a 301
Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses
Load every resource over https:// and add upgrade-insecure-requests to the CSP
Automate certificate renewal and alert well before expiry

How RepoVerse finds it

HighSite is served over plain HTTP
Everything between the visitor and the server — pages, form fields, cookies — can be read and changed by anyone on the network path: public Wi-Fi, an ISP, a compromised router.
website · CWE-319
ModerateThe HTTP address does not redirect to HTTPS
A visitor who types the address without `https://`, or follows an old link, gets an unencrypted page that an attacker on the network can rewrite before they ever reach the secure version.
website · CWE-319
ModerateNo HSTS header
Without `Strict-Transport-Security` the browser will still try plain HTTP for typed addresses and old links, which leaves room for an SSL-stripping attack on the first request.
website · CWE-319
LowHSTS lifetime is short
The browser forgets the HTTPS-only rule quickly, so visitors who come back after the max-age has passed are exposed on their first request again.
website · CWE-319
HighTLS certificate is not trusted
Browsers show a full-page warning. Visitors who click through can no longer tell your server from an impostor's, which is exactly what an interception attack needs.
website · CWE-295
ModerateHTTPS page loads resources over HTTP
Browsers block insecure scripts, styles and frames on an HTTPS page, so those parts break; where they do load (images, media) they can be swapped on the network.
website · CWE-319

Questions

What HSTS max-age should I use?: At least 15552000 seconds (180 days); a year (31536000) is common. Start lower while testing, and add includeSubDomains only once every subdomain serves HTTPS.
Should I submit my site to the HSTS preload list?: Only when you are sure every subdomain will stay on HTTPS: preloading is hard to undo. Add the preload directive and submit at hstspreload.org once the policy has run without problems.

Updated 2026-10-11