Code Maps

Paste a repository and it becomes a city you can walk through: every folder is a building, height is complexity, colour is whatever you need to look at.

Or survey one of these: react/react langchain-ai/langchain expressjs/express

Open the dashboard Public repositories, free. The scanners run on your machine.

Inspection gradeEvery repository leaves with one, A to E.

Walk through the city

The same buildings, six questions. Scroll, and the map answers them one at a time.

  1. 01

    Risk

    Vulnerabilities, insecure configuration, secrets and hotspots, weighted into a single colour. One district is carrying almost all of it.

  2. 02

    Debt

    The same city priced in hours of cleanup. The skyline rearranges itself: the tallest towers are not always the most expensive ones.

  3. 03

    Pulse

    How long ago anyone touched each module. Pale means dormant — and dormant standing next to red is the combination worth worrying about.

  4. 04

    Traffic

    How many commits pass through. These are the corridors the whole team walks down every week.

  5. 05

    The heat map

    The camera goes straight overhead and the skyline disappears. What is left is a thermal map of where the risk collects.

  6. 06

    Ask the AI

    It reads the real code, answers with file and line, and lights up every building it names while you read.

We generate code faster than anyone can read it

A model can write a service in an afternoon. Reviewing it still takes a human a week. The gap between what a team ships and what a team has actually read is the widest it has ever been, and it grows every sprint.

The usual answer is another report: a list of a thousand findings sorted by severity, with no idea which part of the system they live in. You close it and nothing changes, because a list has no geography.

Reports tell you how much is wrong. A map tells you where.

How it works

Three steps, no account, no upload.

  1. Paste a repository

    A GitHub URL or a local path. Public repos are cloned shallow into .repos/ and cached, so the second visit is instant.

  2. The city rises

    Folders become buildings and districts while Trivy, gitleaks and the debt heuristics run locally in the background. The inspection report arrives on its own when they finish.

  3. Inspect, ask, fix

    Click a building to read its findings with file and line. Ask the AI what to fix first: it reads the real code and lights up the buildings it names.

What you see

Every shape on the map means something measurable. Nothing is decoration.

Isometric city of the react/react repository: hundreds of buildings on five coloured district plates, the tallest towers red, a heat stain spreading across the ground.
react/react: 416 buildings, 444.162 lines, grade D. The fixtures district concentrates the vulnerabilities coming from old lockfiles.

Four lenses over the same city

The façade colour is the lens you pick. The buildings never move, so switching lenses shows you the same place answering a different question.

  • RiskVulnerabilities, insecure configuration, secrets and hotspots, weighted.Decide what to fix first.
  • DebtEstimated cleanup hours: TODOs, huge files, deeply branched logic, hotspots.Plan refactors and see which district is rotting.
  • PulseHow long ago anyone touched the module, from git history.Tell living code from sleeping code. Asleep and risky is the worst combination.
  • TrafficHow many commits pass through the module.Find the corridors the whole team walks down.

Hotspots: where the bugs live

A red mast marks code that changes a lot and is complex at the same time — the top 5% of commits times complexity. That combination is the best single predictor of where the next defect appears.

Explore one layer at a time

Click a district to enter it; double-click a building with subfolders to explore it alone. The report recalculates for whatever you are looking at, and the breadcrumbs bring you back.

packages/react-reconciler/src: 47,019 lines, complexity 7,473, a hotspot, with every finding linked to its file and line.

The inspection report

A grade from A to E and a score out of 100, counts by severity, estimated debt hours, the districts and the hotspots. Click a severity row to isolate those buildings and make the rest of the city translucent.

How we measure →

The inspection report for react/react: 47 out of 100, grade D, driven by 215 unpatched critical vulnerabilities.

Constellation view: modules as dots grouped in district regions, connected by directed import edges.
langchain-ai/langchain as a constellation: hovering runnables shows the 13 modules it imports in orange and the 99 that import it in blue.

Bring the findings you already have

Code Maps does not compete with your scanners: it gives them a map. Besides what it runs on its own, it reads the reports of the tools you already use and puts every finding on its building.

Built in

Runs by itself, locally, with nothing to configure.

  • Trivyfree
  • gitleaksfree
  • gitfree

Through a SARIF report

Available today. Drop your tool's .sarif into .codemap/ and analyse again. With a security-severity it counts as security; without one, as debt.

  • Snykfree and paid
  • Semgrepfree and paid
  • CodeQLfree and paid
  • ESLintfree
  • Checkovfree
  • Banditfree
  • gosecfree
  • SARIF 2.1.0free
snyk code test --sarif-file-output=.codemap/snyk.sarif
semgrep scan --sarif -o .codemap/semgrep.sarif

On the roadmap

A direct connection, no files in between. It does not exist yet.

  • SonarQube and SonarCloud API
  • Strix pentest results
  • GitHub App: on every push, and PR comments
  • Slack, Jira and Linear: alerts and tickets

Tested end to end with a sample SARIF 2.1.0 report. Secret values are never read: from a secret scanner only the rule and file:line come through.

Rules: the ones that exist, your team's and your own

Available today

Rules you already know

Trivy's and gitleaks' as they ship, plus the debt heuristics. And any other tool's, through its SARIF report.

Coming soon

Import your team's*

Your .gitleaks.toml, your Semgrep rule packs and your suppressions, applied to all your repositories from one place.

Coming soon

Write your own*

Custom rules over what the map already measures: "no building above 40 complexity without tests", "nothing in billing/ imports from web/".

* Requires a paid Code Maps Cloud plan, which does not exist yet. Pricing →

Ask the AI, and watch it point

The chat is not a summary of a report. The AI has tools that read the repository: it can list findings, open a module, read a file, search the code, and highlight buildings in the city.

So the answer to "what should I fix first?" arrives with file and line numbers, and the buildings it is talking about light up while you read.

  • Cites real file:line, because it opened the file.
  • Highlights in the city every module it mentions.
  • Never receives the value of a secret — only the rule that matched and where.

Where your code goes

Short answer: nowhere, unless you use the chat.

  • The analysis runs on your machine

    Cloning, parsing, git history, Trivy and gitleaks all run as local processes. There is no Code Maps server in the middle and nothing is uploaded.

  • Secret values never leave the scanner

    gitleaks reports the rule that matched and the file and line. Code Maps stores and shows only that. The matched string is never written to disk, never rendered, never sent to the chat.

  • Open source, MIT

    Every heuristic, weight and threshold is in the repository. Read it, disagree with it, change it: github.com/juanarangot/code-map

  • The grade is a published formula

    The score subtracts capped penalties for critical, high and medium findings, for secrets, and for debt hours per thousand lines. It is a heuristic for comparing at a glance, not a standard — and it is written down.

How we measure →

Who it is for

Monolith, monorepo or microservice

For anyone building software

No security team and no company required: a repository is enough. It works with most languages and stacks — JavaScript and TypeScript, Python, Java and Kotlin, Go, Rust, Ruby, PHP, C#, Swift, C and C++, Vue, Svelte… — and with any folder layout: monolith, monorepo or an 80-file microservice.

CTOs and engineering managers
One picture that shows the board, or the team, which part of the system is actually carrying the risk — and how that changes between releases.
Security leads
Vulnerabilities and leaked secrets placed on the architecture instead of in a spreadsheet, so triage starts from blast radius rather than from CVSS order.
Technical due diligence
Walk an unfamiliar codebase in an hour, with a defensible grade, the hotspot list and the debt estimate you can put in the memo.
Anyone onboarding
New to a 400.000-line repository? Start from the shape of it: which districts exist, which towers are load-bearing, and which corners nobody has touched in two years.

What it costs

The open-source edition is the whole product — public repositories, the viewer, the scanners and the AI as a guide — free, today, on your own machine. Code Maps Cloud, with hosted private repos, history, alerts and teams, does not exist yet, and the pricing page says exactly which is which and with what quotas.

See the plans

Questions people actually ask

Why are there so many secrets?

gitleaks flags any string shaped like a key, including examples in documentation and test fixtures. Open the building: if the files are under docs/, *.test.* or a README, they are almost certainly false positives. The real ones usually sit in .env, application.yml or shell scripts.

Why do all the vulnerabilities land in one building?

They come from libraries declared in the manifest at the repository root, not from a specific source file, so they are assigned to the folder that holds the manifest — usually the building called "Dependencies and configuration".

I have zero vulnerabilities. Is that real?

Probably not. Trivy needs a lockfile or compiled artefacts. Without package-lock.json, yarn.lock, gradle.lockfile or jars in build/libs it cannot evaluate dependencies at all.

What does "repository truncated" mean?

The analysis stops at 10.000 code files. Point it at a subfolder instead — for example .repos/owner__repo/packages.

What leaves my machine?

Only the chat talks to an API. It sends the list of modules with their metrics, the findings without secret values, and any file the AI decides to read. The scanners, the analysis and the city are all local.

Why is that building so tall when it has so few lines?

Height is complexity, not size. A file full of nested conditions rises higher than a long flat one.

Do I need Trivy and gitleaks installed?

No. Without them the city still works — you just get no vulnerabilities and no secrets. On macOS, brew install trivy gitleaks turns them on.

Draw the map of a repository you know

Pick one you think you understand. It takes about a minute, and the first surprise usually arrives before the scanners finish.

Open the map Read the source

Looking for design partners and investors. If you run engineering at a company with a codebase nobody can hold in their head, or you invest in developer tools, write to hello@codemaps.co