God's Eye View puts public signals on one Cesium globe: aircraft from OpenSky and adsb.lol, ships from AISStream, satellites from CelesTrak, earthquakes from USGS, NASA fire detections, NOAA weather and cyclone tracks, bike-share and transit feeds, and public traffic cameras from Austin, Calgary, California, Delaware and other road agencies, projected into the 3D city rather than shown as thumbnails. You can lock onto any contact, ride along in a cockpit view, and switch the whole planet through CRT, night-vision and thermal shader styles. With an OpenAI key, a realtime voice agent with 29 tools flies the camera, draws routes and answers questions about what is on screen.
It comes from Bilawal Sidhu, whose God's Eye View videos (earlier called WorldView) drew millions of views before the code was released in June 2026; he maintains it with Sameh Khamis at Halfpixel. It reached number one on GitHub Trending in August and has about 43,700 stars, 30 contributors and a 0.1.1 release. It is a local Node and Vite app, not a hosted service: a small server on localhost holds your API keys and proxies the providers that need them.
The licence needs a careful read. GitHub shows it as unrecognised because the MIT text is followed by a long notice: MIT covers the source code only. The bundled TeleGeography submarine cable map and the Bhote Koshi flood imagery are non-commercial (CC BY-NC-SA 3.0 and CC BY-NC 4.0), the datacenter and dam extracts are ODbL, the 3D aircraft models keep their own licences, and live feeds stay under each provider's terms.
- Repository: github.com/bilawalsidhu/gods-eye-view
- Licence: custom (Other)
- Language: JavaScript. Stars: 43.7K. Forks: 8,888. Last push: Sep 27, 2026.
- Scan: safe, Sep 25, 2026, commit b210ab0
Who it is for
OSINT and geospatial hobbyists, aviation and shipping enthusiasts, video creators after a striking live-data visual, and developers who want a hackable base for their own map layers.
Getting started
1. Clone the repository (Node.js 24.14 or later, or 26; or install it from Pinokio 8.2+ with one click)
git clone https://github.com/bilawalsidhu/gods-eye-view.git && cd gods-eye-view2. Install the locked dependencies
npm ci3. Check the setup, then start the app
npm run doctor && npm run dev4. Open it, pick a first mission, and add optional keys from the POWER UP panel
open http://localhost:4173No keys are needed to start: flights, satellites, earthquakes, cameras and weather work keyless on Esri imagery. Keys typed into POWER UP are saved to a plaintext, owner-only .env in the repository folder. npm ci also downloads a copy of Chrome for Puppeteer, a dev dependency used by the project's screenshot tests.
Safety scan
We cloned bilawalsidhu/gods-eye-view at commit b210ab0 on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across 1,494 files and about 500,000 lines, most of it JavaScript and bundled JSON data. The two bare-IP URLs are in src/data/localReceiversProxy.test.mjs: tests proving the proxy refuses 8.8.8.8 as a local ADS-B receiver address. Hosts like evil.example and example.test are test fixtures too.
- No install hooks in the project itself. npm ci runs the install scripts of three dev dependencies: esbuild and fsevents (native binaries) and Puppeteer, which downloads Chrome for Testing. None ship to the browser.
- package-lock.json pins 203 packages; 202 were checked against OSV and none has a known advisory. The runtime list is short: Cesium, hls.js, satellite.js and seven smaller geo, weather and radio libraries.
- The roughly 40 network hosts the scan lists are the data sources themselves: OpenSky, adsb.lol, CelesTrak, NASA FIRMS and Earthdata, NOAA, InciWeb, GBFS bike shares, road agencies' camera servers, OpenStreetMap, Google Maps and api.openai.com. Secret keys stay on the local server; only the Google Maps and Cesium ion keys reach the browser, by design, so restrict them. Reading the source, we found no analytics or telemetry. The server binds to localhost, and SECURITY.md warns that opening it to a LAN brokers your keys to every device there.
- One workflow, CI, with read-only permissions and no pull_request_target; its four action uses are GitHub's own, pinned to commits. Security policy with a written threat model, licence and contributing guide present; no Dependabot, CodeQL or code of conduct.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. No third-party actions. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, inciweb.wildfire.gov, example.test, maps.googleapis.com. 2 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 0 advisories across 202 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. package-lock.json: 203 packages, 0 advisories. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
URLs to bare IP addresses (2)
| Where | Rule | Match |
|---|---|---|
| src/data/localReceiversProxy.test.mjs:79 | ip-literal-url | '1090=http://8.8.8.8/data/aircraft.json': 'host must be', |
| src/data/localReceiversProxy.test.mjs:195 | ip-literal-url | '1090=http://8.8.8.8/aircraft.json', |
By the numbers
| Stars | 43.7K |
|---|---|
| Forks | 8,888 |
| Contributors | 30 |
| Commits | 512 |
| Open issues | 62 |
| Open pull requests | 146 |
| Releases | 2 |
| Latest release | v0.1.1 |
| Licence | custom |
| Main language | JavaScript |
| Project age | 3 months |
| Last push | Sep 27, 2026 |
| Tracked files | 1,494 |
| Lines of code | 501.4K |
| Checkout size | 103 MB |
Lines by language: JavaScript 392.2K, JSON 81K, CSS 15.7K, Markdown 10.1K, HTML 1,434, Shell 694.
Questions
Is God's Eye View free?
The code is MIT-licensed and free for any use, commercial included. The data is not all covered: the bundled TeleGeography cable map and Bhote Koshi flood imagery are non-commercial, so a commercial user must remove them. Most layers need no key; the free Cesium ion plan is personal and non-commercial, and OpenAI voice is metered, with a $5 per-session cap. A hosted version from Halfpixel is announced.
What API keys does God's Eye View need?
None to start. Flights, satellites, earthquakes, cameras, weather, transit and launches run keyless. Optional keys add features: Cesium ion or Google Maps for photorealistic 3D tiles, OpenAI for voice and the AI HUD summary, AISStream for ships, NASA FIRMS for active fires, TomTom for live congestion, and OpenSky or Launch Library 2 for higher request limits. Only Google Maps and OpenAI are metered.
Does God's Eye View track people or send my data anywhere?
It maps aircraft, ships, satellites, cameras and infrastructure, and the maintainers refuse person search and face recognition. It runs on your machine, and we found no telemetry. Each layer does contact its provider, voice sends your audio and viewport screenshots to OpenAI, and playing a radio station shows the broadcaster your IP address. Mapped license-plate cameras are OpenStreetMap locations only.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.