RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is SHA-256 with a salt good enough for passwords?

No. Salting stops precomputed tables, but SHA-256 is designed to be fast, which is what an attacker cracking passwords wants. Password hashes are deliberately slow and tunable.

How does RepoVerse detect plaintext passwords?

It looks for password fields written to a database through insert, save or create calls with no hashing call anywhere near them and no pre-save hashing hook in the model.

Türkçe

Password storage: hash with bcrypt, scrypt or Argon2

A database of plaintext passwords is a list of logins to other sites, because people reuse passwords. Whoever reads the table — through a backup, an injection or an insider — gets all of them.

Example

Vulnerable

this.addUser = (userName, password, callback) => {
  users.insertOne({ userName, password }, callback);
};

Fixed

const bcrypt = require("bcrypt");

this.addUser = async (userName, password) => {
  const hash = await bcrypt.hash(password, 12);
  return users.insertOne({ userName, password: hash });
};
// at login: await bcrypt.compare(attempt, user.password)

How it goes wrong

Passwords written straight to the users table are the obvious case. Fast hashes are the subtle one: MD5, SHA-1 and plain SHA-256 can be computed billions of times per second on a GPU, so a leaked table of them is cracked in days. Unsalted hashes also let one precomputed table cover every user.

How to fix it

Use a slow, salted password hash and the library's verify function.

bcrypt (cost 12 or more), scrypt or Argon2id
Verify with the library's constant-time compare, never by comparing strings
Rehash on login when you raise the cost
Rate-limit login attempts and do not reveal whether the username exists

How RepoVerse finds it

HighPassword stored without hashing
Anyone who reads the database — a backup, an injection, an insider — gets every user's password, and with it their accounts on other sites.
data flow · CWE-256
ModeratePassword or token hashed with a broken digest
MD5 and SHA-1 are fast and collision-prone, which is exactly wrong for a secret — a commodity GPU walks a stolen table of them.
pattern

Questions

Is SHA-256 with a salt good enough for passwords?: No. Salting stops precomputed tables, but SHA-256 is designed to be fast, which is what an attacker cracking passwords wants. Password hashes are deliberately slow and tunable.
How does RepoVerse detect plaintext passwords?: It looks for password fields written to a database through insert, save or create calls with no hashing call anywhere near them and no pre-save hashing hook in the model.

Updated 2026-10-11