RepoVerse is a free tool that turns any public GitHub repository into an explorable 3D city in the browser. Folders become districts, files become buildings sized by how much code they hold, and the dependencies between them become the roads running from one to another. It runs on Three.js and needs no install and no signup for public repositories.

How does RepoVerse build a city from a repository?

It clones the repository, parses every source file into an abstract syntax tree, and reads the import statements to find what depends on what. That graph is laid out as a city: a folder becomes a district, a file becomes a building whose height is its line count, and each resolved import becomes a road. Git history is read in parallel, so how often a file changes and how recently are visible in the skyline rather than buried in a log.

Yes. Scanning public repositories, exploring the 3D city, sharing a link to one and the written summary every city carries are all free and need no account. A paid plan adds private repositories and the security review, which checks every declared dependency against the OSV vulnerability database and reads the repository's own source for hard-coded credentials, injectable queries and disabled certificate checks.

Which languages does RepoVerse support?

Python, JavaScript, TypeScript and TSX are parsed for functions, classes and imports. Go, Rust, Java, Kotlin, C#, PHP, Ruby, C++ and Swift are mapped as files and districts. RepoVerse can also scan a public website instead of a repository, returning its pages, scripts, stylesheets and the technologies it detects.

Does RepoVerse need access to my private code?

Not for public repositories — those are read anonymously and nothing is stored beyond the generated city. Private repositories need you to sign in with GitHub and grant access, and that token is used only to fetch the repository you asked for. The repository itself is never sent to a third party.

What is the metropolis?

The metropolis is a single 3D world holding every repository anyone has scanned. Each one owns the land around it, projects that share dependencies meet at a border, and the dependencies between them are roads with traffic moving along them. You can fly over it and walk into any city you find.

Are development dependencies a risk?

Less than runtime ones, because they do not ship to users, but they run on developer machines and CI. RepoVerse marks them so production risk is read first.

How often should dependencies be checked?

On every change to the lockfile and on a schedule, because new advisories are published against versions you already have.

Türkçe

Vulnerable dependencies: the code you did not write

A typical web project ships far more third-party code than its own, much of it pulled in indirectly. A known vulnerability in any of it is a known vulnerability in your application.

Example

Locked to a vulnerable release

"node_modules/lodash": {
  "version": "4.17.15"
}
// prototype pollution and command injection advisories apply

Upgraded

"node_modules/lodash": {
  "version": "4.17.21"
}
// one upgrade clears every advisory against 4.17.15

How it happens

Packages are added once and rarely revisited; a lockfile keeps them pinned to the version installed that day. Advisories are published later against those exact versions. Transitive packages — dependencies of dependencies — are the majority and the least visible, and libraries copied into a site from a CDN often stay on the version from the day the page was built.

How to fix it

Upgrade by evidence, not by guesswork.

Check the versions in the lockfile, not the ranges in the manifest
Prefer the upgrade on your current major line that clears every advisory
For transitive packages, upgrade the direct dependency that brings them in
Replace packages that are deprecated or have no fixed release

How RepoVerse finds it

HighFront-end library with known vulnerabilities
The page ships a library version that has published advisories; the vulnerable code runs in every visitor's browser.
website · CWE-1104
LowThird-party script loaded without integrity check
If the CDN or the other site is compromised, the script it serves runs on your pages with full access — the supply-chain path behind several card-skimming attacks.
website · CWE-353

Questions

Are development dependencies a risk?: Less than runtime ones, because they do not ship to users, but they run on developer machines and CI. RepoVerse marks them so production risk is read first.
How often should dependencies be checked?: On every change to the lockfile and on a schedule, because new advisories are published against versions you already have.

Updated 2026-10-11