Syntrabase v1.2.7
GitHub ★ Star
v1.2.7 Released Security Audit Pass, Direct Firestore SDK-to-SDK Migration & Real-Time SOC Defense View Advisory →

The Self-Hosted, Open-Source
Firebase Alternative Built for Production

Enjoy the exact modular Firestore, Auth, Storage, and Realtime developer workflow you love—backed entirely by an authoritative PostgreSQL 16 JSONB foundation you control. Predictable sovereign cloud hosting, zero proprietary vendor lock-in, and enterprise-grade Argon2id, WebAuthn & TOTP security.

Client SDK: npm install @syntrabase/client-sdk
Admin SDK: npm install @syntrabase/admin-sdk
GitHub Repository
Syntrabase Open-Source Firebase Alternative Architecture Banner

100% Familiar Firebase v9/v10 Modular Syntax

Zero learning curve. Keep your existing frontend code patterns while gaining full control of your PostgreSQL database.

import { initializeApp } from '@syntrabase/client-sdk';
import { 
  getAuth, 
  signInWithEmailAndPassword, 
  enrollTotpMfa, 
  createPasskey, 
  verifyPasskeyLogin 
} from '@syntrabase/client-sdk';

// 1. Initialize Modular Syntrabase App
const app = initializeApp({
  apiUrl: 'https://api.yourdomain.com',
  projectId: 'my-production-app',
  apiKey: 'pk_live_f893a7c...'
});
const auth = getAuth(app);

// 2. Primary Password Sign-In (with Step-Up MFA Interception)
const cred = await signInWithEmailAndPassword(auth, 'alice@example.com', 'SecurePass123!');

// 3. Enroll TOTP MFA (Returns Scannable Visual QR Code Data URI)
const { secret, qrCodeUrl, backupCodes } = await enrollTotpMfa(auth);
// <img src={qrCodeUrl} alt="Scan in Authenticator App" />

// 4. Register WebAuthn FIDO2 Biometric Passkey (TouchID, FaceID, YubiKey)
const passkey = await createPasskey(auth);
console.log('Hardware Passkey bound:', passkey.credentialId);

// 5. Seamless Passwordless Sign-In via Passkey Assertion
const { user } = await verifyPasskeyLogin(auth, { email: 'alice@example.com' });
import { 
  getFirestore, 
  collection, 
  doc, 
  setDoc, 
  getDoc, 
  query, 
  where, 
  orderBy, 
  limit, 
  serverTimestamp, 
  increment, 
  runTransaction 
} from '@syntrabase/client-sdk';

const db = getFirestore(app);

// 1. Set Document with Atomic Server Timestamp
await setDoc(doc(db, 'movies', 'movie_789'), {
  title: 'Hamrawit 2026',
  rating: 4.8,
  status: 'released',
  createdAt: serverTimestamp() // Syntrabase replaces sentinel atomically
});

// 2. PostgreSQL GIN Index-Accelerated Query
const q = query(
  collection(db, 'movies'),
  where('status', '==', 'released'),
  orderBy('rating', 'desc'),
  limit(20)
);

// 3. Optimistic ACID Transaction with Auto-Rollback
await runTransaction(db, async (txn) => {
  const showDoc = await txn.get(doc(db, 'screenings', 'screening_pro'));
  if (showDoc.data().availableSeats <= 0) throw new Error('Screening sold out');

  txn.update(doc(db, 'screenings', 'screening_pro'), {
    availableSeats: increment(-1)
  });
});
import { getFirestore, doc, onSnapshot } from '@syntrabase/client-sdk';

const db = getFirestore(app);
const docRef = doc(db, 'live_streams', 'stream_channel_42');

// Subscribe to instantaneous WebSocket document updates
// Enforces token-first handshake and multi-tenant project isolation
const unsubscribe = onSnapshot(docRef, (snapshot) => {
  const data = snapshot.data();
  console.log('Live Stream Viewers Received in <10ms:', data.activeViewers, data.channel);
  updateViewerDisplay(data.activeViewers);
});

// Cleanly tear down subscription when unmounting view
// unsubscribe();
import { getStorage, ref, uploadBytes, getDownloadURL } from '@syntrabase/client-sdk';

const storage = getStorage(app);
const fileRef = ref(storage, 'invoices/inv_2026_10.pdf');

// 1. Isomorphic Upload (Browser File/Blob or Node.js Buffer)
const result = await uploadBytes(fileRef, userSelectedFile, {
  contentType: 'application/pdf'
});

// 2. Acquire Cryptographically Tamper-Proof Signed URL
// Server-side enforcement with Content-Security-Policy & X-Content-Type-Options: nosniff
const downloadUrl = await getDownloadURL(fileRef);
console.log('Direct Download Link:', downloadUrl);
import { initializeAdminApp, getAdminAuth, getAdminFirestore, getAdminAudit } from '@syntrabase/admin-sdk';

// 1. Privileged Initialization (Node.js Only with sk_live_... Secret)
// Built-in browser guardrail immediately throws if executed inside window
const adminApp = initializeAdminApp({
  apiUrl: 'https://api.yourdomain.com',
  projectId: 'my-production-app',
  secretKey: process.env.SYNTRABASE_SECRET_KEY
});

const adminAuth = getAdminAuth(adminApp);

// 2. Enforce Strict Project-Wide MFA & User Action Policies
await adminAuth.setUserActions({
  emailEnumerationProtection: true,
  enableCreate: true,
  enableDelete: false // Prevent user account self-deletion
});

await adminAuth.setMfaPolicy({
  state: 'enforced',
  enforceAllUsers: true,
  allowedFactors: ['totp', 'passkey']
});

// 3. Verify Cryptographic HMAC Audit Ledger Chain
const audit = getAdminAudit(adminApp);
const ledgerStatus = await audit.verifyLedger();
console.log('Audit Chain Intact:', ledgerStatus.valid);

Engineered for Sovereign Control & Extreme Performance

Everything required to run mission-critical production SaaS without cloud vendor taxation.

FIDO2 Passkeys & Visual TOTP MFA

Modern passwordless WebAuthn biometric authentication paired with RFC 6238 TOTP issuing instant base64 QR code data URIs and 8 cryptographic backup codes.

PostgreSQL 16 JSONB Power

Full ACID compliance, transactional rollbacks, atomic field transforms (`serverTimestamp`, `increment`), and direct SQL access whenever you need analytics.

Token-First Realtime WebSockets

Sub-10ms change broadcasting with strict tenant isolation. Authenticated clients only receive real-time streams matching their authorized project ID.

Signed Storage & CSP Hardening

Object storage with HMAC-SHA256 signed download tokens, path traversal guards, strict quota calculation, and CSP `default-src 'none'` headers.

Privileged Admin SDK

Secure server-side user management, custom claims, MFA policy administration, and automated browser guardrails preventing accidental credential exposure.

Predictable Sovereign Hosting

1-Click deployment via Coolify or Docker. Scale to 10M+ operations on your sovereign infrastructure without pay-per-read billing surprises.

Official Documentation • v1.2.7

Complete SDK Guides & API Reference

Drop-in Firebase v9/v10 syntax, enterprise FIDO2 WebAuthn passkeys, visual TOTP QR MFA, and PostgreSQL 16 JSONB primitives.

Getting Started • Architecture

Overview & Architecture

Syntrabase is an open-source, multi-tenant developer platform engineered as a high-performance, drop-in replacement for Google Firebase. While Firebase relies on closed Google Cloud primitives with unpredictable pay-per-read billing models, Syntrabase runs natively on PostgreSQL 16 JSONB.

Predictable Sovereign Infrastructure: Run your entire SaaS (Auth, Firestore, Storage, Realtime) with 10M+ operations without risking unbounded pay-per-read cloud bills.

The Syntrabase ecosystem consists of two first-class SDK packages:

  • @syntrabase/client-sdk@^1.2.7: Tree-shakeable, modular client library for browsers and mobile applications matching Firebase v9/v10 functional syntax.
  • @syntrabase/admin-sdk@^1.2.7: Privileged Node.js server library using master sk_live_... keys for backend microservices, Next.js server actions, and background workers.
Installation • Packages

Installation & Package Ecosystem

Install the modular client SDK in your web application (Next.js, Vite, React, Vue, Svelte, or Vanilla JS):

npm install @syntrabase/client-sdk@^1.2.7

For Node.js backend servers, server actions, or administrative microservices, install the admin SDK:

npm install @syntrabase/admin-sdk@^1.2.7
Configuration • Security

Configuration, Keys & Environments

Syntrabase enforces strict separation between public client credentials and privileged master secrets. Never leak master secrets into frontend client bundles:

Security Protocol: Publishable keys (pk_live_...) are safe for browser code and obey Security Rules. Master secret keys (sk_live_...) are restricted to backend servers and bypass all client security rules. 
# Frontend Application Environment (.env.production)
NEXT_PUBLIC_SYNTRABASE_URL=https://api.yourdomain.com
NEXT_PUBLIC_SYNTRABASE_PROJECT_ID=saas-production-app
NEXT_PUBLIC_SYNTRABASE_API_KEY=pk_live_839a7b1c4e6f9d2a015b7e8c3f

# Server-Side Only Backend Environment (Never bundle in client)
SYNTRABASE_SECRET_KEY=sk_live_your_admin_secret_key_sample
SYNTRABASE_ENVIRONMENT=production # 'production' | 'staging' | 'development'
Client SDK • Initialization

App Initialization (Client SDK)

Initialize the application instance by providing your API gateway endpoint, project ID, and publishable key:

import { initializeApp } from '@syntrabase/client-sdk';

export const app = initializeApp({
  apiUrl: process.env.NEXT_PUBLIC_SYNTRABASE_URL || 'https://api.yourdomain.com',
  projectId: 'saas-production-app',
  apiKey: 'pk_live_839a7b1c4e6f9d2a015b7e8c3f',
  environmentId: 'production' // 'default' | 'development' | 'staging' | 'production'
});
Client SDK • Authentication

Authentication & Sessions

The Auth module provides user registration, login, anonymous guest sessions, password resets, and session management:

import { 
  getAuth, 
  createUserWithEmailAndPassword, 
  signInWithEmailAndPassword, 
  signInAnonymously,
  getUserSessions,
  revokeUserSession,
  signOut 
} from '@syntrabase/client-sdk';

const auth = getAuth(app);

// 1. Register with email & password (Argon2id hashing)
const { user } = await createUserWithEmailAndPassword(auth, 'alice@example.com', 'SuperPass123!');

// 2. Sign In (Returns tokens or { mfaRequired: true, mfaToken: '...' })
const result = await signInWithEmailAndPassword(auth, 'alice@example.com', 'SuperPass123!');
if (result.mfaRequired) {
  console.log('Step-up MFA required! Token:', result.mfaToken);
}

// 3. Inspect active device sessions
const sessions = await getUserSessions(auth);
console.log('Active sessions:', sessions);

// 4. Revoke a specific session
await revokeUserSession(auth, sessions[0].id);
Client SDK • TOTP 2FA

TOTP MFA & Visual QR Codes

Syntrabase includes built-in RFC 6238 TOTP two-factor authentication. When enrolled, the SDK returns the secret, an OTPAuth URI, and a pre-rendered visual base64 QR code data URI ready for direct display in an <img> element, alongside 8 cryptographic backup recovery codes.

Universal Scannability: Generates authentic RFC 6238 compliant QR codes scanned effortlessly by Google Authenticator, Microsoft Authenticator, Authy, Apple Passwords, and 1Password. 
import { getAuth, enrollTotpMfa, verifyTotpMfa, unenrollTotpMfa } from '@syntrabase/client-sdk';

const auth = getAuth(app);

// 1. Enroll TOTP Factor (Returns QR Code Data URI & Recovery Codes)
const { secret, otpauthUrl, qrCodeUrl, backupCodes } = await enrollTotpMfa(auth);

// Render directly in your React / HTML view:
// Scan QR Code in Authenticator App

// 2. Complete enrollment by verifying first 6-digit rolling code:
await verifyTotpMfa(auth, '583921');
console.log('TOTP 2FA successfully activated on account!');

// 3. Unenroll factor when requested:
// await unenrollTotpMfa(auth);
Client SDK • FIDO2 WebAuthn

WebAuthn FIDO2 Passkeys

Users can register physical security keys (YubiKey) or platform biometrics (TouchID, FaceID, Windows Hello) for passwordless authentication:

Phishing-Resistant Architecture: WebAuthn cryptographic keys are bound to your domain origin and stored in the client hardware's Secure Enclave / TPM. 
import { getAuth, createPasskey, verifyPasskeyLogin } from '@syntrabase/client-sdk';

const auth = getAuth(app);

// 1. Register Passkey on current account
// Triggers native browser navigator.credentials.create() with challenge nonces
const passkeyResult = await createPasskey(auth);
console.log('Passkey registered:', passkeyResult.credentialId);

// 2. Passwordless Sign-In via Passkey
// Triggers native browser navigator.credentials.get()
const { user } = await verifyPasskeyLogin(auth, { email: 'alice@example.com' });
console.log('Authenticated passwordless as:', user.email);
Client SDK • Document Database

Firestore Document Database (CRUD)

All document CRUD operations use identical modular v9/v10 syntax. Data is persisted in PostgreSQL 16 JSONB columns with automatic schema indexing: 

import { 
  getFirestore, 
  collection, 
  doc, 
  addDoc, 
  setDoc, 
  getDoc, 
  updateDoc, 
  deleteDoc 
} from '@syntrabase/client-sdk';

const db = getFirestore(app);

// 1. Create document with auto-generated UUID
const docRef = await addDoc(collection(db, 'notes'), {
  title: 'Weekly Sprint Planning',
  author: 'Alice',
  published: true
});

// 2. Set or overwrite explicit document
await setDoc(doc(db, 'notes', 'custom_id_1'), {
  title: 'Architecture Overview',
  version: 2
});

// 3. Read document
const snapshot = await getDoc(doc(db, 'notes', 'custom_id_1'));
if (snapshot.exists()) {
  console.log('Document Data:', snapshot.data());
}

// 4. Update specific fields
await updateDoc(doc(db, 'notes', 'custom_id_1'), {
  version: 3
});

// 5. Delete document
await deleteDoc(doc(db, 'notes', 'custom_id_1'));
Client SDK • GIN Index Queries

Queries & Filtering

Filter and order documents with composable query constraints. Backed by PostgreSQL GIN indexes for sub-millisecond filtering: 

import { getFirestore, collection, query, where, orderBy, limit, getDocs } from '@syntrabase/client-sdk';

const db = getFirestore(app);

const q = query(
  collection(db, 'movies'),
  where('genres', '==', 'Thriller'),
  where('rating', '>=', 4.5),
  orderBy('rating', 'desc'),
  limit(25)
);

const querySnapshot = await getDocs(q);
querySnapshot.forEach((doc) => {
  console.log(doc.id, '=>', doc.data());
});
Client SDK • Field Transforms

Atomic Field Transforms

Perform atomic in-database calculations without read-before-write race conditions: 

import { 
  getFirestore, 
  doc, 
  updateDoc, 
  serverTimestamp, 
  increment, 
  arrayUnion, 
  arrayRemove, 
  deleteField 
} from '@syntrabase/client-sdk';

const db = getFirestore(app);

await updateDoc(doc(db, 'analytics', 'page_views'), {
  views: increment(1),                      // Atomic math
  updatedAt: serverTimestamp(),             // Replaced with authoritative DB ISO timestamp
  tags: arrayUnion('tech', 'postgresql'),    // Add unique array items
  deprecatedField: deleteField()             // Purges property from JSONB
});
Client SDK • ACID Transactions

Batch Writes & Transactions

Syntrabase brings true PostgreSQL ACID transactional integrity to modular Firestore code. Read-modify-write transactions auto-retry on conflict and roll back cleanly on errors: 

import { 
  getFirestore, 
  doc, 
  runTransaction, 
  writeBatch, 
  increment 
} from '@syntrabase/client-sdk';

const db = getFirestore(app);

// 1. ACID Transaction (Seat Reservation / Content Allocation)
await runTransaction(db, async (txn) => {
  const showDoc = await txn.get(doc(db, 'screenings', 'screening_x1'));
  if (showDoc.data().availableSeats <= 0) {
    throw new Error('Screening sold out');
  }

  // Atomically decrement seats and record reservation
  txn.update(doc(db, 'screenings', 'screening_x1'), {
    availableSeats: increment(-1)
  });
  txn.set(doc(db, 'reservations', 'res_5502'), {
    screeningId: 'screening_x1',
    status: 'confirmed'
  });
});

// 2. Atomic Batch Writes (Up to 500 operations in one roundtrip)
const batch = writeBatch(db);
batch.set(doc(db, 'logs', 'log_1'), { event: 'user_login' });
batch.update(doc(db, 'users', 'user_1'), { lastActive: new Date().toISOString() });
await batch.commit();
Client SDK • WebSockets

Realtime WebSockets (onSnapshot)

Stream instantaneous database mutations over persistent WebSocket connections. Handshakes enforce authentication tokens and multi-tenant project isolation: 

import { getFirestore, doc, onSnapshot } from '@syntrabase/client-sdk';

const db = getFirestore(app);
const liveDocRef = doc(db, 'live_streams', 'stream_101');

// Listen to sub-10ms change events
const unsubscribe = onSnapshot(liveDocRef, (snapshot) => {
  const data = snapshot.data();
  console.log('Instantaneous Stream Update:', data.viewerCount, data.streamStatus);
  renderLiveViewerCount(data.viewerCount);
});

// Cleanly disconnect WebSocket subscription on view unmount
// unsubscribe();
Client SDK • Object Storage

Storage & Signed Download URLs

Secure object storage backed by standard cloud buckets or local disk volumes. Access is protected by HMAC-SHA256 signed download tokens and path traversal guards: 

import { getStorage, ref, uploadBytes, getDownloadURL } from '@syntrabase/client-sdk';

const storage = getStorage(app);
const avatarRef = ref(storage, 'avatars/user_42.png');

// 1. Upload File with Quota & Content-Type Enforcement
const fileBlob = new Blob(['avatar_image_bytes'], { type: 'image/png' });
const uploadResult = await uploadBytes(avatarRef, fileBlob);
console.log('Uploaded size:', uploadResult.size, 'bytes');

// 2. Generate HMAC-Signed Download URL (Expires in 3600 seconds)
const downloadUrl = await getDownloadURL(avatarRef);
console.log('Signed download URL:', downloadUrl);
Admin SDK • Privileged

Privileged Initialization (Server Only)

The Admin SDK is strictly designed for Node.js environments. It uses a privileged sk_live_... secret key and bypasses client security rules: 

import { initializeAdminApp } from '@syntrabase/admin-sdk';

export const adminApp = initializeAdminApp({
  apiUrl: process.env.SYNTRABASE_API_URL || 'https://api.yourdomain.com',
  projectId: 'saas-production-app',
  secretKey: process.env.SYNTRABASE_SECRET_KEY // sk_live_...
});
Admin SDK • Identity

User Management & Claims

Manage users, assign custom claims for Role-Based Access Control (RBAC), and programmatically revoke user sessions across all devices: 

import { getAdminAuth } from '@syntrabase/admin-sdk';

const adminAuth = getAdminAuth(adminApp);

// 1. Assign Enterprise Role & Custom Claims
await adminAuth.setCustomUserClaims('user_123', {
  role: 'super_admin',
  organizationId: 'org_enterprise_42',
  canAccessBilling: true
});

// 2. Fetch User Record
const userRecord = await adminAuth.getUser('user_123');
console.log('User Claims:', userRecord.customClaims);

// 3. Immediately Revoke All Active Sessions
await adminAuth.revokeAllUserSessions('user_123');
Admin SDK • Security Gating

User Actions & Gating Policy

Programmatically configure enterprise user action policies to prevent account enumeration, spam registrations, and self-deletion: 

import { getAdminAuth } from '@syntrabase/admin-sdk';

const adminAuth = getAdminAuth(adminApp);

// Configure User Action Security Policies
await adminAuth.setUserActions({
  emailEnumerationProtection: true, // Returns identical timing responses for existing vs non-existing emails
  enableCreate: true,                // Allow public end-user sign-ups
  enableDelete: false                // Disallow end-users from self-deleting accounts
});
Admin SDK • MFA Policy

Project MFA & Factor Admin

Configure organization-wide two-factor enforcement policies and specify authorized MFA factors: 

import { getAdminAuth } from '@syntrabase/admin-sdk';

const adminAuth = getAdminAuth(adminApp);

// Enforce Organization-Wide MFA Requirements
await adminAuth.setMfaPolicy({
  state: 'enforced',                 // 'enforced' | 'optional' | 'disabled'
  enforceAllUsers: true,             // Requires all members to enroll before granting tokens
  allowedFactors: ['totp', 'passkey']
});
Admin SDK • Audit Ledger

Cryptographic Audit Ledger

Syntrabase records all privileged administrative operations into an immutable, append-only HMAC-SHA256 ledger. Any attempt to modify audit rows invalidates the cryptographic hash chain:

Compliance Ready: Built-in tamper detection verifies ledger cryptographic validity for SOC 2, HIPAA, and ISO 27001 compliance standards. 
import { getAdminAudit } from '@syntrabase/admin-sdk';

const audit = getAdminAudit(adminApp);

// Cryptographically verify entire audit ledger hash chain
const status = await audit.verifyLedger();
console.log('Audit Integrity Verified:', status.valid, 'Total Records:', status.count);
Security Guardrail

Browser Runtime Safety Guardrail

To prevent developers from accidentally bundling server master secrets (sk_live_...) into browser client bundles, @syntrabase/admin-sdk includes an active runtime environment check: 

// Active browser guardrail (Packages/admin-sdk)
if (typeof window !== 'undefined' || typeof document !== 'undefined') {
  throw new Error(
    '[@syntrabase/admin-sdk] FATAL: Admin SDK cannot be executed in browser environments. ' +
    'Use @syntrabase/client-sdk with publishable keys (pk_live_...) for client-side applications.'
  );
}
Zero-Trust • Security Architecture

Security Advisory & Cryptographic Audit Matrix

Syntrabase enforces continuous authorized red team testing and zero-trust verification across every layer of the platform. All 49 identified threats across platform and SDK releases (v1.0.0 through v1.2.7) have been systematically eliminated and validated through 123/123 automated integration and security regression test gates.

SDK Core Security Advisory & Changelog Available

Explore the complete transparent breakdown of all 49 audited security vulnerabilities, threats identified, what was fixed and secured, and verified before/after code diffs in the SDK Security Advisory & Changelog →

Cryptographic Audit Ledger Verification

Syntrabase records all privileged administrative operations into an append-only, HMAC-SHA256 hashed ledger chain. Verify ledger continuity programmatically via the Admin SDK: 

import { initializeAdminApp, getAdminAudit } from '@syntrabase/admin-sdk';

const adminApp = initializeAdminApp({
  apiUrl: 'http://localhost:4000',
  projectId: 'default-project',
  secretKey: process.env.SYNTRABASE_MASTER_SECRET!
});

const audit = getAdminAudit(adminApp);

// Cryptographically verify entire audit ledger hash chain
const ledgerStatus = await audit.verifyLedger();
console.log('Ledger verified:', ledgerStatus.valid); // true: chain intact
console.log('Verified entries:', ledgerStatus.totalVerified);
Quality Assurance • Gates

Automated Test Bench & Gates

All Syntrabase packages and services are covered by strict automated regression suites using native Node.js test runners (zero extra test dependencies): 

# Run unit, integration, and security suites (117/117 passing)
npm run test

# Run isolated client bundle browser guardrail checks
npm run test:security --workspace=@syntrabase/client-sdk

# Run privileged admin SDK test runner
npm run test:unit --workspace=@syntrabase/admin-sdk
Release Verification & Changelog

Release & Platform Changelog (v1.2.7 & SDK v1.2.7)

Syntrabase v1.2.7 platform and SDK v1.2.7 are fully verified for enterprise production deployments with 49/49 security audits passing, 100% Firebase Admin/Client drop-in parity, and zero open vulnerabilities.

SDK v1.2.7 Highlights & Drop-In Parity:
  • Standard 20-Character Auto IDs: Matches Firebase 20-character cryptographically secure base62 document identifiers (e.g., 0dfZdeHBcIAUxeG7ttyi) with zero prefix anomalies.
  • Instant Realtime Cache Reactivity: Local mutation broadcasts synchronize instantaneously with onSnapshot subscribers, maintaining zero latency on updates.
  • Privilege Escalation Defense: Server-side AuthService.isSuperAdmin() PostgreSQL validation rejects forged claims and enforces absolute tenant boundaries.
  • Upload Security & Anti-Spam: Multi-layer upload protection with 60 ops/min rate limiting, path traversal validation (.. and leading slash guards), and forbidden executable extension blocking.
  • Authoritative SMTP Sender Resolution: Platform email infrastructure automatically prioritizes administrator-configured DB sender identities before environment fallbacks.
  • Firebase Admin Drop-in Namespace: import admin from '@syntrabase/admin-sdk' with admin.initializeApp({ credential: admin.credential.cert(...) }), admin.firestore(), and admin.auth().
  • Document & Query Snapshot Parity: DocumentSnapshot with boolean .exists, method .data(), .id, and QuerySnapshot with .docs, .forEach(), and for..of iteration.
  • Persistence Engines: browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, inMemoryPersistence, and dynamic setPersistence().
  • Multi-Tab Firestore Cache: enableIndexedDbPersistence, enableMultiTabIndexedDbPersistence, and offline cache synchronization.
  • Firestore Datatypes & Query Operators: Timestamp, GeoPoint, Bytes, FieldPath, documentId(), limitToLast, cursor pagination, and()/or() queries.
# Run PostgreSQL 16 schema migrations
npm run db:migrate --workspace=apps/api

# Verify system health endpoint
curl -f http://localhost:4000/api/v1/health

Syntrabase SDK Studio & Test Bench

Execute live automated regression tests or interactively verify Client & Admin SDK operations in real-time.

Checking Gateway...
? Unauthenticated

Client SDK 1-Click Automated Verification

Sequentially runs 10 deep verification steps testing Auth, CRUD, Transforms, Batch, Transactions, MFA & Storage.

Admin SDK Privileged Verification Suite

Validates privileged server execution with sk_live_... master secret key, audit ledger, and browser guardrails.

Authentication & MFA Playground

Test registration, login, anonymous auth, TOTP visual QR code enrollment, and WebAuthn passkeys.

MFA, WebAuthn & Recovery

Firestore Document & Query Playground

Test modular v9/v10 CRUD, queries, atomic field transforms, write batch, and transactions.

Advanced Capabilities

Realtime WebSocket Listener (onSnapshot)

Establish real-time WebSocket subscription to instantly receive document update broadcasts.

Listener Status: Idle (Not Connected)

Awaiting subscription...

Storage Object Playground

Test isomorphic uploadBytes with File / Blob, getDownloadURL signed tokens, listAll, and deleteObject.

SYNTRABASE LIVE STREAM ● Live
[INIT] Syntrabase Client SDK Studio loaded. Ready to test.
● Gateway: http://localhost:4000 1 Log Entry
Authorized Red Team Security Advisory • 49/49 Remediated & Verified

SDK & Core Security
Advisory & Changelog

Comprehensive transparent record of all 49 security vulnerabilities identified across previous and current SDK versions. Inspect what was exposed, what threats were identified, and exactly how each vector was patched, hardened, and regression tested.

Audits Remediated
49 / 49
100% Remediated • 0 Open CVEs
Automated Test Gates
123 / 123
123 Automated Integration & Security Tests Passing (100%)
Cryptographic Ledger
HMAC-SHA256
Append-Only Immutable Hash Chain
Maximum CVSS Defended
CVSS 9.8
Critical RCE, BOLA & SQLi Neutralized

SDK & Core Security Advisory Changelog

Browse all historical vulnerabilities, attack vectors, and patches deployed across previous and current SDK versions.

Showing 49 of 49 Security Updates
Severity: Category:

Syntrabase vs Google Firebase vs Supabase

Architectural comparison showing why developers choose Syntrabase for production sovereign control.

Feature Capability Google Firebase Supabase Syntrabase
Database Engine Proprietary Google NoSQL PostgreSQL (Row-oriented) PostgreSQL 16 JSONB + GIN
Firebase v9/v10 API Compatibility Native (Vendor-Locked) No (Requires rewriting to supabase-js) 100% Drop-In Compatible
Self-Hosting & Independence Impossible (Google Cloud Only) Complex (30+ microservices) 1-Click Coolify / Single Docker
Pricing Model Uncapped Pay-Per-Read / Write Tiered + Egress Overages Predictable Sovereign Hosting (Unlimited Reads)
FIDO2 WebAuthn Passkeys Paid Google Identity add-on Enterprise Tier Native Built-In (SimpleWebAuthn)
Visual TOTP MFA QR Codes SMS / Cloud Add-ons Limited Native Base64 Data URI QR Codes
Email Infrastructure Cloud Functions needed Basic SMTP Built-in Brevo HTTPS + DNS Verification
Cryptographic Audit Ledger Paid Cloud Audit Logging No built-in chain Tamper-Evident HMAC Forward Chain