RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is log injection a serious vulnerability?

It is usually rated low on its own, but it undermines the logs you rely on to investigate every other incident, and can chain into XSS in log viewers.

How does RepoVerse find log injection?

It traces request input to console and logger calls. Signature-verified webhook payloads are not treated as attacker input.

Türkçe

Log injection: forging entries in your own logs

Logs are evidence. When request data is written to them unescaped, a line break in that data lets the caller add entries of their own.

Example

Vulnerable

console.log("Login failed for user:", req.body.userName);
// userName = "alice\nINFO Login succeeded for user: admin"

Fixed

const clean = String(req.body.userName).replace(/[\r\n]/g, "");
logger.warn({ event: "login_failed", user: clean });
// or a structured logger that writes values as JSON fields

How it happens

A username of alice followed by a newline and INFO Login succeeded for user: admin produces two log lines, the second written by the attacker. Forged entries can cover tracks, frame another user or confuse alerting rules. Logs shown in a web dashboard add a second risk: HTML in the entry can become XSS in the viewer.

How to fix it

Keep each value inside its own entry.

Strip or encode \r and \n from user data before logging
Prefer a structured logger (pino, winston with JSON) that writes values as fields
Escape log content when displaying it in HTML
Avoid logging secrets and full request bodies at all

How RepoVerse finds it

LowRequest input written to the log unescaped
A value with line breaks forges extra log entries — a fake "login succeeded" line, or noise that hides the real attack from whoever reads the logs later.
data flow · CWE-117

Questions

Is log injection a serious vulnerability?: It is usually rated low on its own, but it undermines the logs you rely on to investigate every other incident, and can chain into XSS in log viewers.
How does RepoVerse find log injection?: It traces request input to console and logger calls. Signature-verified webhook payloads are not treated as attacker input.

Updated 2026-10-11