baas
Layer 1 — Domain Foundation
Universal Backend-as-a-Service principles that apply regardless of platform.
Firebase, Supabase, Appwrite — these principles hold.
Philosophy
BaaS is a fundamentally different architecture from custom backends. There are
no controllers, no middleware, no routes. The client talks directly to platform
services, and security rules replace the API layer. Agents trained on custom
backend patterns (Express, Django) apply those patterns to BaaS — building REST
APIs in Cloud Functions, normalizing data for a database that can't JOIN, and
treating security as a client-side concern. Every pattern in this pack corrects
a specific failure that arises from applying custom-backend thinking to BaaS.
What's Included
| Type |
Count |
Coverage |
| Patterns |
8 |
Security rules as auth, data modeling for queries, minimize functions, real-time by default, platform auth, offline support, typed models, cost management |
| Anti-patterns |
7 |
Open rules in production, REST API in functions, client-side auth, relational normalization in NoSQL, untyped raw data, one-time fetches everywhere, no billing awareness |
| Constitution |
8 |
principles |
Grounded in: Firebase official docs, Supabase official docs, Firebase security
checklist, ModernPentest security research (2024-2025), Fireship data modeling
guides, and community best practices.
Activation
Loads when the project is detected as using a BaaS platform (Firebase SDK,
Supabase client, or similar in dependencies).
What This Pack Does NOT Cover
- Platform-specific API details (see future
firebase, supabase)
- Framework integration patterns (detection-gated inside the framework skill,
e.g.
flutter/integration/firebase-integration.md)
- Custom backend patterns (see
api for custom API development)
1---2name: baas3description: baas4---56# baas78**Layer 1 — Domain Foundation**910Universal Backend-as-a-Service principles that apply regardless of platform.11Firebase, Supabase, Appwrite — these principles hold.1213## Philosophy1415BaaS is a fundamentally different architecture from custom backends. There are16no controllers, no middleware, no routes. The client talks directly to platform17services, and security rules replace the API layer. Agents trained on custom18backend patterns (Express, Django) apply those patterns to BaaS — building REST19APIs in Cloud Functions, normalizing data for a database that can't JOIN, and20treating security as a client-side concern. Every pattern in this pack corrects21a specific failure that arises from applying custom-backend thinking to BaaS.2223## What's Included2425| Type | Count | Coverage |26|------|-------|----------|27| Patterns | 8 | Security rules as auth, data modeling for queries, minimize functions, real-time by default, platform auth, offline support, typed models, cost management |28| Anti-patterns | 7 | Open rules in production, REST API in functions, client-side auth, relational normalization in NoSQL, untyped raw data, one-time fetches everywhere, no billing awareness |29| Constitution | 8 | principles |3031Grounded in: Firebase official docs, Supabase official docs, Firebase security32checklist, ModernPentest security research (2024-2025), Fireship data modeling33guides, and community best practices.3435## Activation3637Loads when the project is detected as using a BaaS platform (Firebase SDK,38Supabase client, or similar in dependencies).3940## What This Pack Does NOT Cover4142- Platform-specific API details (see future `firebase`, `supabase`)43- Framework integration patterns (detection-gated inside the framework skill,44 e.g. `flutter/integration/firebase-integration.md`)45- Custom backend patterns (see `api` for custom API development)
xoai