JavaScript Code Analyzer
Paste a public GitHub URL and REPO-SIGHT reads your JavaScript source directly — complexity, common footguns, and 15 rules built specifically for JavaScript. Free.
What REPO-SIGHT checks in your JavaScript code
15 rules, tuned for JavaScript — 7 of them security-specific. .mjs, .cjs, and .jsx are all analyzed as JavaScript.
Complexity & structure
Cyclomatic complexity, max nesting depth (flagged past 6 levels), and functions over 100 lines — the same thresholds used in the health score.
Loose equality & var usage
js-loose-equality (== vs ===) and js-var-usage catch two of the oldest, most common sources of confusing JavaScript bugs.
Swallowed exceptions
js-empty-catch-block flags catch blocks that discard the error instead of handling or logging it.
XSS & injection risk
js-sec-inner-html, js-sec-sql-string-concat, and js-sec-eval flag three well-known routes to injected code or markup.
Disabled TLS & weak crypto
Disabled TLS certificate checks, child_process.exec, hardcoded secrets, and weak hashes round out 7 security checks in total.
Duplication & debt
Token-based clone detection across the whole repo, plus every TODO/FIXME counted — js-todo-without-ticket flags the ones with no ticket reference.
if (userId == null) {
return defaultUser;
}Illustrative example. js-loose-equality: == triggers type coercion, so this also matches undefined and, depending on context, other falsy values you may not have intended — === compares without coercing.
Frequently asked questions
Does it analyze .jsx, .mjs, and .cjs files?
Yes — all three extensions are analyzed as JavaScript, alongside plain .js.
What's the difference between this and the TypeScript analyzer?
Same rule categories, tuned per language: TypeScript's analyzer additionally checks type-safety patterns like explicit-any that don't apply to untyped JavaScript. See the TypeScript code analyzer.
Does REPO-SIGHT run my JavaScript?
No. It's static analysis only — the source is parsed, never executed, so a flagged eval() call is reported, not run.
Is it actually free?
Yes — no tiers, no paywalled metrics. A small amount of advertising covers hosting instead of a paid plan.
Other languages
Related reading
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.