RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Does URL-decoding matter for path traversal?

Yes. Encoded forms such as %2e%2e%2f decode to ../ before the file system sees them, so checks must run on the decoded, resolved path.

How does RepoVerse find path traversal?

It traces request input into fs calls and res.sendFile, res.download and similar sinks, and treats basename() and literal-led paths as safe.

Türkçe

Path traversal: reading files outside the intended folder

When a request supplies part of a file path, ../ walks up out of the folder you meant and into the rest of the file system.

Example

Vulnerable

app.get("/files", (req, res) => {
  res.sendFile(path.join(__dirname, "uploads", req.query.name));
});

Fixed

const BASE = path.resolve(__dirname, "uploads");

app.get("/files", (req, res) => {
  const target = path.resolve(BASE, String(req.query.name));
  if (!target.startsWith(BASE + path.sep)) return res.sendStatus(400);
  res.sendFile(target);
});

How it happens

Download endpoints, image resizers and template loaders join a base folder with a name from the request. path.join does not stop ../../../../etc/passwd; neither does checking that the string starts with the folder name before it is resolved. Writes are worse than reads: overwriting a startup script or a template turns traversal into code execution.

How to fix it

Resolve first, then check.

Map an identifier to a stored path on the server instead of accepting paths
Otherwise resolve the full path and confirm it is still inside the base directory
Use path.basename when only a file name is expected
Run the process with the least file-system access it needs

How RepoVerse finds it

HighRequest input becomes a filesystem path
`../` sequences walk out of the intended directory and read or overwrite any file the process can reach.
data flow · CWE-22
ModerateRequest value joined into a filesystem path
A path is built from something that arrived with the request.
pattern

Questions

Does URL-decoding matter for path traversal?: Yes. Encoded forms such as %2e%2e%2f decode to ../ before the file system sees them, so checks must run on the decoded, resolved path.
How does RepoVerse find path traversal?: It traces request input into fs calls and res.sendFile, res.download and similar sinks, and treats basename() and literal-led paths as safe.

Updated 2026-10-11