RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is MongoDB immune to injection because it has no SQL?

No. $where executes JavaScript, and query operators passed in from a request change which documents match. Both are classified as CWE-943.

How does RepoVerse detect NoSQL injection?

It traces request input into $where strings — including across files into a data-access layer — and flags request values used directly as filter values, which can carry operator objects.

Türkçe

NoSQL injection: rewriting MongoDB queries from a request

NoSQL databases do not parse SQL, but they still interpret structure. A request that sends an object where you expected a string, or text that ends up inside a $where expression, changes what the query means.

Example

Vulnerable

// $where runs JavaScript inside MongoDB
allocations.find({
  $where: `this.userId == ${userId} && this.stocks > '${req.query.threshold}'`
});

// {"password": {"$ne": null}} matches any user
users.findOne({ user: req.body.user, password: req.body.password });

Fixed

const threshold = Number.parseInt(req.query.threshold, 10);
if (!(threshold >= 0 && threshold <= 99)) return res.sendStatus(400);
allocations.find({ userId, stocks: { $gt: threshold } });

users.findOne({ user: String(req.body.user) });
// then compare the password hash with bcrypt.compare

How it happens

Two shapes. $where takes JavaScript that MongoDB runs for every document, so a value such as 1'; return true; ' returns everything and a busy loop can stall the server. Operator injection is quieter: body parsers turn password[$ne]= into {"$ne": ""}, and a login query that drops the request value in unchanged then matches any account.

How to fix it

Keep request data as plain values.

Do not use $where; express conditions with query operators
Cast values to the type you expect (String, Number) before querying
Enable Mongoose sanitizeFilter, or strip keys starting with $ from input
Look users up by name, then verify the password hash separately

How RepoVerse finds it

HighRequest input runs inside a MongoDB `$where` expression
`$where` is JavaScript evaluated by the database. A crafted value can return every document (`1'; return true; '`) or hang the server (`';while(true){}'`).
data flow · CWE-943
ModerateRequest value used directly as a MongoDB filter value
If the body parser accepts objects, `{"$ne": null}` or `{"$gt": ""}` in that field matches any document — the classic login bypass.
data flow · CWE-943

Questions

Is MongoDB immune to injection because it has no SQL?: No. $where executes JavaScript, and query operators passed in from a request change which documents match. Both are classified as CWE-943.
How does RepoVerse detect NoSQL injection?: It traces request input into $where strings — including across files into a data-access layer — and flags request values used directly as filter values, which can carry operator objects.

Updated 2026-10-11