RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Does express-session set HttpOnly by default?

Yes, express-session's cookie is HttpOnly by default, but not Secure. Setting httpOnly: false or leaving Secure unset are both reported.

Should anti-CSRF cookies be HttpOnly?

No. Frameworks such as Django and Angular read the CSRF cookie from JavaScript on purpose, so RepoVerse does not ask for HttpOnly on csrftoken or XSRF-TOKEN cookies.

Türkçe

Secure session cookies: the flags and the login step

The session cookie is the account. Three flags decide who can read it and when it is sent, and one line at login decides whether someone else can share it.

Example

Vulnerable

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: { httpOnly: false },
}));

function login(req, res, user) {
  req.session.userId = user.id; // same session id as before login
}

Fixed

app.set("trust proxy", 1);
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: { secure: true, httpOnly: true, sameSite: "lax", maxAge: 8 * 3600 * 1000 },
}));

function login(req, res, user) {
  req.session.regenerate(() => { req.session.userId = user.id; res.redirect("/"); });
}

How it goes wrong

Without Secure the cookie also travels over plain HTTP, where anyone on the network can read it. Without HttpOnly, one injected script can read it and send it away. Without SameSite, other sites' forms carry it along. And if the session ID is not changed at login, an ID planted before login stays valid after it — session fixation.

How to fix it

Set the flags explicitly; do not rely on defaults.

Secure on every cookie of an HTTPS site (behind a proxy, trust it so Express knows)
HttpOnly on session and auth cookies
SameSite=Lax or Strict on session cookies
Regenerate the session on login and destroy it on logout

How RepoVerse finds it

ModerateSession cookie may be sent over plain HTTP
Without `secure`, the session cookie travels on any HTTP request and can be read on the network. (express-session already sets HttpOnly by default; Secure it does not.)
data flow · CWE-614
HighSession cookie readable by page scripts
`httpOnly: false` lets any injected script read the session cookie and take over the account.
data flow · CWE-1004
ModerateSession not regenerated at login
A session id planted before login stays valid after it, so whoever planted it shares the logged-in session.
data flow · CWE-384
ModerateCookie set without its protective flags
A session cookie without `httpOnly` is readable by script, and without `secure` it travels over plain HTTP.
pattern · CWE-1004
ModerateCookie set without the Secure flag
The browser will also send this cookie over plain HTTP, where anyone on the network can read it.
website · CWE-614
ModerateSession cookie readable by page scripts
Without `HttpOnly`, one injected script can read the session cookie and send it away, handing over the logged-in account.
website · CWE-1004

Questions

Does express-session set HttpOnly by default?: Yes, express-session's cookie is HttpOnly by default, but not Secure. Setting httpOnly: false or leaving Secure unset are both reported.
Should anti-CSRF cookies be HttpOnly?: No. Frameworks such as Django and Angular read the CSRF cookie from JavaScript on purpose, so RepoVerse does not ask for HttpOnly on csrftoken or XSRF-TOKEN cookies.

Updated 2026-10-11