RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Does escaping quotes prevent SQL injection?

Not reliably. Escaping depends on the database, the encoding and the context inside the query. Parameterised queries remove the problem rather than trying to neutralise it.

How does RepoVerse find SQL injection?

It follows request input through assignments and function calls — across files — to calls such as query, execute and raw, and reports a traced finding with the path when the input reaches the SQL text. Numeric conversions end the trail.

Türkçe

SQL injection: what it is and how to fix it

SQL injection happens when text from a request becomes part of the SQL statement itself instead of a value the statement uses. The attacker stops supplying data and starts writing the query.

Example

Vulnerable

app.get("/users", async (req, res) => {
  const name = req.query.name;
  const rows = await db.query(
    "SELECT * FROM users WHERE name = '" + name + "'"
  );
  res.json(rows);
});

Fixed

app.get("/users", async (req, res) => {
  const rows = await db.query(
    "SELECT * FROM users WHERE name = $1",
    [String(req.query.name)]
  );
  res.json(rows);
});

How it happens

The database cannot tell which part of a string-built query the developer wrote and which part came from the request. A name of ' OR '1'='1 turns a lookup into a dump of every row; a value ending in a comment removes the password check from a login query; stacked statements can modify or delete data. ORMs prevent most of this until someone reaches for a raw query or builds a WHERE clause with a template string.

How to fix it

Send values separately from the statement.

Use placeholders ($1, ?, :name) and pass values as parameters
Use the query builder or ORM methods instead of raw SQL with interpolation
Convert numbers with Number or parseInt and check their range before use
Never build table or column names from input; map allowed names explicitly

How RepoVerse finds it

HighRequest input is built into a SQL statement
The caller can rewrite the query: read other users' rows, bypass a login check, or modify data.
data flow · CWE-89
HighSQL built by string interpolation
A query is assembled out of variables instead of being parameterised.
pattern
HighSQL assembled with format or concatenation
A SQL string is produced by `%`, `.format()`, f-string or `+` before being run.
pattern

Questions

Does escaping quotes prevent SQL injection?: Not reliably. Escaping depends on the database, the encoding and the context inside the query. Parameterised queries remove the problem rather than trying to neutralise it.
How does RepoVerse find SQL injection?: It follows request input through assignments and function calls — across files — to calls such as query, execute and raw, and reports a traced finding with the path when the input reaches the SQL text. Numeric conversions end the trail.

Updated 2026-10-11