RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Is a URL starting with my own domain safe from SSRF?

When the host part is fixed and input only fills in the path, the server cannot be pointed elsewhere. RepoVerse treats a URL led by a literal host or a fixed base such as API_BASE_URL as safe and keeps reporting input that can still reach the host.

How does RepoVerse handle SSRF in its own website scanner?

Every request and every redirect is resolved and checked against private, loopback, link-local and reserved ranges, only ports 80 and 443 are used, and the socket connects to the address that was checked.

Türkçe

SSRF: when a request decides where your server connects

Server-side request forgery turns your server into a proxy. If request input chooses the URL your code fetches, an attacker can reach whatever your server can: internal APIs, admin panels, the cloud metadata service.

Example

Vulnerable

app.get("/preview", async (req, res) => {
  const response = await fetch(req.query.url);
  res.send(await response.text());
});

Fixed

const API = "https://api.example.com/quotes/";

app.get("/quote", async (req, res) => {
  const symbol = String(req.query.symbol);
  if (!/^[A-Z]{1,5}$/.test(symbol)) return res.sendStatus(400);
  const response = await fetch(API + encodeURIComponent(symbol), { redirect: "error" });
  res.json(await response.json());
});

How it happens

URL previews, webhooks, PDF renderers and import-from-URL features all fetch addresses supplied by users. A value of http://169.254.169.254/latest/meta-data/ asks a cloud VM for its own credentials; http://localhost:6379 talks to an internal Redis. Redirects and DNS names that resolve to private addresses get around naive blocklists.

How to fix it

Let input choose as little of the URL as possible.

Build the URL from a fixed base and validate only the variable part
If arbitrary hosts are a feature, resolve the name and refuse private, loopback and link-local addresses — on every redirect too
Connect to the address you checked, so DNS rebinding cannot swap it
Disable or re-check redirects, and cap response size and time

How RepoVerse finds it

HighRequest input chooses where the server sends an HTTP request
Under the right network conditions the server can be made to call internal services or the cloud metadata endpoint (169.254.169.254) and hand the response back.
data flow · CWE-918
HighRequest sent to a URL from the caller
The address is chosen by whoever made the request, so this will happily fetch `169.254.169.254` and hand back the cloud credentials behind it.
pattern · CWE-918

Questions

Is a URL starting with my own domain safe from SSRF?: When the host part is fixed and input only fills in the path, the server cannot be pointed elsewhere. RepoVerse treats a URL led by a literal host or a fixed base such as API_BASE_URL as safe and keeps reporting input that can still reach the host.
How does RepoVerse handle SSRF in its own website scanner?: Every request and every redirect is resolved and checked against private, loopback, link-local and reserved ranges, only ports 80 and 443 are used, and the socket connects to the address that was checked.

Updated 2026-10-11