·
Last changedVersion:
This version passed the hardening gate. Hardening applied 32 targeted changes and preserved all other text. Classified findings before hardening: 15. Classified findings closed: 8. Classified findings remaining: 7. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 9.
6
9
6
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
reference/schema.md | Prompt Injection | Direct prompt injection | Medium | Open | |
reference/sdk_admin_node.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
templates.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
reference/config.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
SKILL.md | Prompt Injection | Direct prompt injection | Medium | Open | |
reference/config.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Low | Closed |
15 findings
Firebase SQL Connect is a relational database service using Cloud SQL for PostgreSQL with GraphQL schema, auto-generated queries/mutations, and type-safe SDKs.
Rely on these two mechanisms to ensure project correctness:
.dataconnect/schema/main/).npx firebase-tools@latest dataconnect:compile against the schema.Always default to Native GraphQL. Native SQL lacks type safety and bypasses schema-enforced structures. Only use Native SQL when the user explicitly requests it or when the task requires advanced database features.
| Strategy | When to use | Implementation |
|---|---|---|
Native GraphQL (Default) | Almost all use cases. Standard CRUD, basic filtering/sorting, simple relational joins. Requires full type safety. | Auto-generated fields ( |
Native SQL (Advanced) | PostgreSQL extensions (e.g., PostGIS), window functions ( | Raw SQL string literals via |
Follow this strict workflow to build your application. You must read the linked reference files for each step to understand the syntax and available features.
schema/schema.gql)Define your GraphQL types, tables, and relationships (which map to a Postgres schema).
connector/queries.gql, connector/mutations.gql)Write the queries and mutations your client will use, including authorization logic. SQL Connect is secure by default.
Generate type-safe code for your client platform.
Configure SDK generation in connector.yaml:
Generate SDKs:
For platform-specific instructions on how to use the generated SDKs, read:
If you need to implement a specific feature, consult the mapped reference file:
| Feature | Reference File | Key Concepts |
|---|---|---|
Data Modeling |
| |
Vector Search |
| |
Full-Text Search |
| |
Upserting Data |
| |
Complex Filters |
| |
Transactions |
| |
Environment Config |
| |
Realtime Subscriptions |
| |
Cloud Functions Integration |
| |
Data Seeding & Migrations |
| |
Starter Templates | CRUD, user-owned resources, many-to-many, SDK init |
Follow these patterns based on your current task:
npx firebase-tools@latest init dataconnect.npx firebase-tools@latest emulators:start --only dataconnect.seed_data.gql. Read
reference/data_seeding.md.npx firebase-tools@latest dataconnect:compile or
npx firebase-tools@latest dataconnect:sdk:generate to validate them.npx firebase-tools@latest deploy --only dataconnect.For complete, working code examples of schemas and operations, see examples.md.
For ready-to-use starter templates (CRUD, user-owned resources, many-to-many, YAML configs, SDK init), see templates.md.
Get started with chainctlchainctl skill install public/firebase/firebase-data-connect-basics:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/firebase/skills/firebase-data-connect-basics:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
examples.md
reference/cloud_functions.md
reference/config.md
reference/data_seeding.md
reference/native_sql.md
reference/operations.md
reference/realtime.md
reference/schema.md
reference/sdk_admin_node.md
reference/sdk_android.md
reference/sdk_flutter.md
reference/sdk_ios.md
reference/sdk_web.md
reference/search.md
reference/security.md
templates.md