RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is every nested quantifier dangerous?

No. If each repetition must start with a fixed character the rest of the group cannot match — (\.\d+)* in a version number — there is only one way to split the input and matching stays linear. RepoVerse tells these apart instead of flagging every nested group.

Why is ReDoS worse in Node.js?

Regular expressions run on the main thread, so a slow match blocks every other request on the server until it finishes.

Türkçe

ReDoS: how one regular expression can stall a server

Some regular expressions take exponential time on input that almost matches. In Node.js, where one event loop serves every request, one such match stops the whole server.

Example

Vulnerable

const BANK_ROUTING = /([0-9]+)+\#/;

app.post("/profile", (req, res) => {
  if (!BANK_ROUTING.test(req.body.bankRouting)) return res.sendStatus(400);
  save(req.body);
});

Fixed

const BANK_ROUTING = /^[0-9]{1,17}#$/;

app.post("/profile", (req, res) => {
  const value = String(req.body.bankRouting).slice(0, 32);
  if (!BANK_ROUTING.test(value)) return res.sendStatus(400);
  save(req.body);
});

How it happens

A repeated group whose contents can themselves repeat — (a+)+, ([0-9]+)+, (\w+\s?)+ — gives the engine many ways to split the same input. When the overall match fails, it tries all of them. Thirty digits followed by a character that breaks the match can take seconds; forty can take minutes. Compiling a pattern from user input (new RegExp(req.query.q)) hands the attacker the pattern itself.

How to fix it

Make each repetition unambiguous.

Remove the nested quantifier: ([0-9]+)+ becomes [0-9]+
Anchor the pattern and bound repetition counts ({1,17})
Cap input length before matching
Escape user input before building a pattern, or compare strings instead

How RepoVerse finds it

HighRequest input is matched against a backtracking-prone regular expression
Nested quantifiers backtrack exponentially. A few dozen crafted characters pin the CPU, and in Node's single event loop that stalls every request on the server.
data flow · CWE-1333
ModerateRequest input is compiled into a regular expression
The caller supplies the pattern itself, including one that backtracks forever.
data flow · CWE-1333
LowRegular expression that can be made to hang
Nested quantifiers like `(a+)+` backtrack exponentially, so a crafted input of a few dozen characters pins a CPU core.
pattern · CWE-1333

Questions

Is every nested quantifier dangerous?: No. If each repetition must start with a fixed character the rest of the group cannot match — (\.\d+)* in a version number — there is only one way to split the input and matching stays linear. RepoVerse tells these apart instead of flagging every nested group.
Why is ReDoS worse in Node.js?: Regular expressions run on the main thread, so a slow match blocks every other request on the server until it finishes.

Updated 2026-10-11