RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is an open redirect a serious vulnerability?

It is usually rated moderate on its own, but it makes phishing far more convincing and can be chained with OAuth or SSRF weaknesses into something worse.

How does RepoVerse detect open redirects?

It traces request input to res.redirect, Location headers and framework redirect helpers, and does not report destinations that begin with a literal local path.

Türkçe

Open redirect: your domain as a phishing link

An open redirect forwards visitors to whatever address a parameter names. The link starts with your trusted domain; the page it ends on belongs to someone else.

Example

Vulnerable

app.get("/learn", (req, res) => {
  res.redirect(req.query.url);
});

Fixed

app.get("/learn", (req, res) => {
  const target = String(req.query.url ?? "/");
  // a single leading slash: same site only (not //evil.com, not /\evil.com)
  const local = /^\/(?![\/\\])/.test(target);
  res.redirect(local ? target : "/");
});

How it happens

Login flows and tracking links take a return URL — ?next=, ?url=, ?redirect= — and pass it straight to res.redirect or a Location header. Attackers send links like https://your-site.com/learn?url=https://your-site.login-check.com, which pass the visual check and land on a copy of your login page. Combined with OAuth flows, an open redirect can also leak authorisation codes.

How to fix it

Only redirect where you meant to.

Allow relative paths that start with exactly one /
Or compare the destination with an allowlist of hosts
Watch for //evil.com and /\evil.com, which browsers treat as other hosts
Store the return path server-side instead of in the URL when you can

How RepoVerse finds it

ModerateRequest input decides where the user is redirected
A link on your own domain forwards victims to any site — the mechanic of a convincing phishing page.
data flow · CWE-601
ModerateRedirect target taken from the request
The caller chooses where this sends people, which is the whole mechanic of a convincing phishing link on your own domain.
pattern · CWE-601

Questions

Is an open redirect a serious vulnerability?: It is usually rated moderate on its own, but it makes phishing far more convincing and can be chained with OAuth or SSRF weaknesses into something worse.
How does RepoVerse detect open redirects?: It traces request input to res.redirect, Location headers and framework redirect helpers, and does not report destinations that begin with a literal local path.

Updated 2026-10-11