# Synapse Platform Documentation > Synapse · SYN-DOCS · Last updated: 19 September 2026 · https://synapsehubs.net/docs Complete reference for accounts, publishing, supported file formats, security, sandbox behaviour and usage guidelines. ## Getting started First visit → useful account Synapse is a members site for publishing projects, posting problems, joining groups, browsing Network posts (investor / company), and messaging other people. This instance does **not process payments** — there is no donate, checkout, or express-interest flow. Create an account Gmail + password (confirm a 6-digit email code) or Continue with Google. Finish onboarding Pick Developer, Investor, or Company. Set a public display name. You get a unique @handle and an 8-character profile ID. Use the header Create / Archive / Problems / Groups / Network / Messages. Turn on 2FA in Settings → Security. Start publishing from Create. Discover work on Archive. Need the rules that bind the site? See Terms and Privacy. ## Accounts & identity What others see vs what stays private Public profile Display name, optional avatar & banner, bio, skills, @handle, and profile ID. URLs look like `/u/yourhandle` and `/id/ABCD2345`. Email stays private unless you turn on “show email” in Settings. Unsafe display names are blocked on save; mild hits open a 1-day warning, severe hits can suspend immediately. Groups show a public ID like `G-XXXXXXXX`. Account types **Developer** — publish projects and problems. **Investor / Company** — org profile, optional Network directory listing, verification request flow (review is operator-side). Payments stay locked. Sign-in methods Email accounts use a password (stored only as a bcrypt hash). Google accounts never share your Google password with Synapse. Either kind can enable an authenticator app (TOTP) in Settings. You can list and revoke sessions from other devices. Team / org helpers Investor and company profiles can invite team members on the org card. Team roles are for collaboration on that profile — they do not bypass ownership of projects you personally created. ## Projects & publishing Creator Studio — what visitors actually get Create is a multi-step wizard: basics → media & files → documentation → license & links → review. On media and later steps you get a **live preview** of the public page (hero / sandbox and docs) before you publish. How files are attached **ZIP** → stored as attachment URLs. **Folder upload** → a browsable `file_tree` (junk folders like `node_modules` / `.venv` are skipped). Loose files are fine for covers, videos, and one-off downloads. Default max is **300 MB per file**, **1.2GB for video**, and **300 MB for a 3D model** (one per upload) — unless the operator changed these. Format chips on Create are discovery tags (40+). See Files & previews for upload vs Synapse render vs download-only. What visitors see A display plan picks the hero (video, cover, gallery, interactive 3D, audio, or Synapse sandbox). You can override that in the wizard. Overview renders Markdown docs. Files tab shows README (if present), the source tree, and downloads when you allow them. HTML / JS are listed as source by default — a standalone `.html` file can also be opened with a "Run (sandboxed)" toggle, which plays it inside an isolated sandbox with no access to Synapse's cookies, session, or API. Installers (.exe/.msi/.apk) and archives stay download-only — they can never run inside Synapse at all, only after you download and install them yourself. License & comments You keep ownership. The license you pick is what others may do with that work — choose carefully (license index). Comments can be turned off per project. When on, threads appear under Discussion with types like feedback, question, and bug report. Draft vs published Save draft or publish from the last step. Edit later with `/create?edit=…` from your project page when you are the owner. Synapse does **not process payments**. A listed price or “looking for investors” tag is discovery only. ## Write-ups & Markdown What “Copy Markdown link” is for — and what actually renders Every public project has an About write-up. You type it in Create (or optionally override with a chosen .md file). That text is Markdown: headings, lists, tables, images from your files, `#tags`, and diagrams. Raw HTML and JavaScript in a write-up are **not executed**. Copy Markdown link (the ⋮ menu) On a post such as CodeMind-architecture-AI, the kebab copies a snippet like `[CodeMind-architecture-AI](…/project/…)`. **What it is for:** paste that into another project’s write-up, a README, a group post, or a comment. Synapse turns the title into a clickable chip (labeled Project) that opens that post in the app — not a raw website address. **What it is not:** it is not a download, not a license grant, not an embed of the other project’s files, and not a secret admin URL. Copy page link vs Markdown link **Copy page link** — a normal URL for chat, email, or another website. **Copy Markdown link** — the title plus URL in Markdown form, for write-ups and comments on Synapse (and any other Markdown editor that understands `[text](url)`). What you can write Headings with ##. Lists and tables. Images that point at files you uploaded. `#LLM`-style tags that link to Archive search. Diagrams: a fenced block starting with mermaid (flowcharts, sequence, class, and similar). Synapse draws them in the sandbox theme. Same-site links to projects, problems, groups, and profiles stay inside the app. Off-site http(s) links open in a new tab and are checked so javascript: URLs never become buttons. Where it shows up Overview on the public post, README in Files when you pick one, comments and replies, Network posts, group posts, and problem write-ups. Comments: paste the Markdown snippet and it becomes a Project chip with the title you copied — so a name like CodeMind-architecture-AI is the label, not a hostname. ## Problems, groups, Network & investors The rest of the product, as it ships today Problems & workspace Post a problem with files, then open the in-browser workspace to edit text, preview media, and keep revision history of saves. Formal solutions live under Solutions; Discussion is for questions and hints. Collaborator saves can ping the owner (Settings → Workspace edits). Groups Create or join a group, post in the feed, reply in threads. Each group gets a short public ID (G-XXXXXXXX). Owners manage members and settings. Joining someone else’s group can notify the owner. Unsafe group names are blocked on save. Network posts Investor / company posts (jobs, RFPs, etc.) use a full-page editor with scheduling when allowed. Public detail pages render Markdown. Verification is a request + operator review — not a paid badge store. Direct messages One-to-one chat. Conversations refresh by short polling (and push when the connection allows). You can edit or delete your own messages. Blocking stops new DMs both ways. Message alerts respect Settings → Messages. Follows Follow other members. Follower / following lists live on each profile. A new follow can notify the person you followed, unless they turned Follows off in Settings. Investors page Pipeline of posts marked as seeking capital, plus signals you sent or received. Charts are activity snapshots. Payment buttons stay locked; reported “raised” figures are not escrowed money. Notifications The bell lists follows, likes, comments, messages, group joins/mentions, and workspace edits. Filter on the full inbox. You can turn each category off in Settings. You are never notified about your own actions. Money features (locked) Donation and express-interest buttons are disabled platform-wide. Figures on a project are not live balances. Any real money talk is off-site and your responsibility under the law that applies to you. ## Views, likes, comments & alerts How counts, discussion, and the bell behave Views (YouTube-like, not forever-once) Opening a project or problem page records a view. The same browser can count again after a short cooldown (about **20 seconds**) so refreshes do not spam the counter, but returning later still increments. Viewers are identified with a small **session cookie** (`synapse_vid`), not by “logged-in user may only ever count once.” Different browsers / devices count separately. Counts on cards and detail pages stay in sync across the site via a lightweight live feed (and short polls when push is unavailable). Likes Likes require sign-in. Toggling like updates the count for everyone watching that item. There is no separate analytics product or third-party tracker. Comments On projects (when enabled) and problems, comments support types, replies, likes, edit/delete of your own posts, and optional pasted images. Paste a Markdown link copied from another post — it becomes a titled Project chip, not a hostname. #tags link to Archive search. New comments show up for others within a few seconds (poll backup if live push cannot connect). Notifications (bell) Follows, likes, comments, messages, group joins/mentions, and workspace saves. The dropdown is a short preview; /notifications is the full inbox with filters. Each category has a switch in Settings. System notices (warnings, suspensions) still arrive. Duplicate pings from the same action are folded so the bell stays light. What views are not Not ad impressions, not a paid ranking product, not sold to advertisers. Operators may use aggregates for moderation and capacity — not for selling your browsing history. Automatic safety (names & content) Profile names, handles, group names, project/problem titles, Network post titles, org firm/company names, comments, group posts, and messages are checked on every save. Mild / general hits: warn first (1–2 day fix window), then escalate if still unsafe. Severe hits (hate, threats, sexual, scam, child-safety): **immediate suspension**with durations based on severity (including permanent). A background scan also scrubs legacy bad labels. ## Files & previews 57+ Create tags · three different meanings of “supported” “Supported” on Synapse is not one switch. Create’s format chips are **discovery tags**(57 options today) — they describe what is in the project. Separately, the upload API accepts almost any project file (default **300 MB** for most files, **1.2GB** for video, and **300 MB** for a 3D model — one model per upload). Preview is a third story: only some extensions go through **Synapse’s own renderers**; the rest still upload and download. 1 · Upload / store Bytes land on disk or object storage. Only a tiny set of browser page types is blocked (.xhtml, .shtml, .swf, .hta). HTML/JS/SVG still upload for IDE use but are served as text so they cannot run as pages. 2 · Synapse render Our gallery, video/audio players, PDF embed, Three.js 3D (GLB/GLTF/OBJ/FBX/STL), and the custom sandbox (RTL maps, SPICE, Markdown, highlighted code). 3 · Download-only Installers, archives, CAD packages, Blender, Unity packages, spreadsheets, and many other tags — listed in the tree / downloads, opened with your tools. How Synapse’s preview pipeline works Opens with Synapse’s own viewers (gallery, video, audio, PDF, interactive 3D). Processed by Synapse’s post sandbox — hardware maps, circuits, docs, highlighted code. Also previewed (beyond Create tags) AVIF / HEIC / BMP / ICO — Image gallery when decodable. MKV / M4V / AVI — Video if the browser can play the codec. M4A — Audio controls. YouTube URL — Embedded via youtube-nocookie. Sandbox extras (folder / IDE files) V / SV / VHDL / VHD — RTL → Synapse hardware module map + source. CIR / SPICE / SP / SCH — Circuit netlist → Synapse circuit summary + source. PY / RS / GO / JAVA / C / C++ / … — Syntax-highlighted code pane (many languages). YAML / XML / TOML / TSV — Data / config text preview. MDX / RST / ADOC — Document-style text / markdown family. Labels: Renders in Synapse · Synapse sandbox · Source / text preview · Upload & download. Interactive 3D today = GLB, GLTF, OBJ, FBX, STL. Other 3D tags still upload. ## Speed, cache & storage Why pages should feel light — without listing servers One origin, hashed assets The public site and API share one host. JavaScript/CSS filenames include a content hash and are cached for a long time. HTML is not cached, so a deploy shows up on the next visit. Compression API and page responses are compressed when the browser asks. Live stats streams are left uncompressed so they are not delayed. Uploads Files land on this instance’s disk, or object storage if the operator configured it. Unique filenames can be cached hard. There is no public “list the whole bucket” page. Synapse does not recompress 3D or re-encode video for you. Size & junk filters Default 300 MB per file (1.2GB for video, 300 MB for a 3D model). Folder uploads skip dependency / virtualenv junk. Oversized or unreadable uploads are rejected. Live counts without hammering Views, likes, and comments use a short-lived connection when it works, and slower polling when the tab is visible. Hidden tabs do not keep polling. The home marketing block does not fade in from invisible, so the page does not bounce twice. Images in the tab Images you already loaded can be reused in the same visit. That is a local convenience cache, not a tracker. No money pipeline Uploading does not start payouts, invoices, or escrow. What we do not publish here Operator machine addresses, internal hostnames, and database locations stay off this page. Public traffic uses HTTPS at the edge of this instance. ## Reports, warnings & appeals How members escalate problems — and how suspensions work Three public channels (footer + header where shown): **safety reports** (harassment, hate, scams, impersonation, threats, sexual content), **site feedback** (bugs and ideas), and **appeals** (challenge a suspension with your side of the story). Safety and feedback require a normal signed-in session. Appeals also work after a suspended account verifies email/password or Google once — that unlocks a short **appeal-only** session (not full site access). - Header flag or footer Report - Header Feedback or footer Feedback — bugs / ideas only - Footer Appeal (next to Docs) — suspensions and mistaken bans - Report on a profile — fills @handle and profile ID for you Up to four screenshots. Empty spam is rejected. Filing is rate-limited. Bad public names/content are **blocked on save** — you do not wait for someone else to file a report. Mild cases warn first (1-day fix window); severe cases suspend immediately. Ban durations used by operators and automation: **1 / 3 / 7 / 14 / 30 days or permanent**. Evidence is stored on the ban record so appeals are reviewed against facts, not as a black box. A suspended account cannot use the rest of the site until the ban ends or an operator lifts it. Posts, comments, and related public content from a suspended account are **soft-hidden** (kept in the database, removed from feeds/search/chat) — not deleted. Direct messages with that account are blocked while the ban is active. Discovery uses a **5-level trust ranking** (Restricted → Caution → Standard → Established → Trusted). Clean, established accounts rank higher in search and feeds. Warnings step trust down; bans force Restricted. Trust recovers slowly after clean time (about a week) once warnings expire and the ban is lifted. ## Security — full picture Server, browser, uploads, and what you still control Written to match the live stack (Express + Helmet + Postgres, Vite/React front end). Legal wording lives in the Privacy Policy. Accounts & sessions Passwords & Google Email passwords are stored only as bcrypt hashes — Synapse cannot show them back. Google sign-in never receives your Google password. Your session lives in an HttpOnly cookie the browser sends automatically — no page script, extension, or injected code can read it, and it's cleared on logout. Two-factor (TOTP) Optional authenticator codes. Secrets sit in a dedicated table, separate from the public profile. Enable under Settings → Security — once on, changing your @handle also requires a fresh code. Revocable sessions Each sign-in creates a server session ID. Logout or “revoke device” invalidates that session on the API immediately — closing one tab is not enough if you leave another device signed in. Rate limits Login, signup, password reset, reports, uploads, and owner-console unlock slow down after repeated hits. This is abuse control, not a hidden reputation score. Server (API & storage) Private fields stay private Email (unless you publish it), payout notes, notification prefs, and similar fields are returned only to the owner. Other members receive the public profile shape only. Ownership on every write You cannot grant yourself admin from DevTools. Project/problem edits check ownership. Likes and views only move through dedicated actions — not by patching a JSON counter. Upload hardening Almost any project file can be uploaded. Only a few browser-executable page types are blocked. HTML/JS/SVG still upload for the IDE but are served as text/plain + nosniff so they cannot run as pages. Default size cap 300 MB per file (the operator can lower it). How files are served Files are served through Synapse routes, not as a public bucket listing. HTML/JS/SVG/CSS are sent as plain text with nosniff so a direct link never runs as a page on Synapse's own origin — the only way to run an .html file at all is the opt-in sandbox described below. URL & media sanitization On create/update, media and link fields are filtered to http(s) or trusted upload paths. javascript: and similar schemes are rejected before they are stored. View cookie A first-party HttpOnly cookie applies the short view cooldown per browser. It is not an advertising ID and is not sold. No payment processor Donate, checkout, and investor-interest writes are rejected. Raised totals cannot be forged from the browser. Off-site deals are between members. Browser origins Cross-site browser calls to the API are limited to this instance’s allowed front ends. Unknown sites cannot ride your session from another origin. Browser & front end HTTPS & security headers Public instances sit behind HTTPS. The API sends Helmet headers, a Content Security Policy, and a permissions policy that does not ask for camera, microphone, location, or in-browser payments. Content Security Policy CSP defaults to same-origin scripts, blocks object embeds, and forbids framing the app in other sites. Dangerous schemes such as javascript: in media are blocked in the browser even if bad data slipped through. Markdown & comments User Markdown is rendered without running raw HTML as a site. Link destinations are checked so javascript: URLs do not become clickable actions. Same-site project links show the copied title, not a server hostname. Web sources: source by default, sandboxed if you ask HTML / JS / CSS / SVG open as highlighted source (or plain text) by default — nothing runs automatically just from opening a project. A standalone .html file adds a "Run (sandboxed)" toggle that plays it inside an isolated frame with its own scripting-only permissions: no cookies, no session, no calling Synapse's API, no reaching the rest of the page. It never runs as a live app on Synapse's own origin. 3D & media viewers The Three.js viewer and media players load only http(s)/upload URLs the app already accepted. They are not a general “run arbitrary plugins” surface. What you should still do Unique password, turn on 2FA, never paste secrets into public files, and report impersonation early. No stack is perfect — see Privacy for breach language. Threat model in one line ## How the site talks to itself Same-origin /api — not a public developer platform There is **no public API key product**, no partner webhook catalog, and no “build third-party apps” program. The React app calls `/api` on the same host with your session. Live-feeling updates (views, likes, comments, feeds) use a mix of short polling and optional push channels. If a live connection cannot be established, the site falls back to polling and a stats stream so counts and comments still move. Editing data in DevTools cannot invent permissions. The server checks ownership, session validity, bans, and rate limits on every write. ## Usage guidelines Practical rules that keep the archive useful Content you upload Only publish work you own or have rights to share under the license you pick. Credit originals on derivatives. Stolen, illegal, or abusive material can be removed and accounts suspended. File size & honesty Stay within the per-file cap. Do not upload malware, credential dumps, or scrapers. The site stores what you send — it is not a free CDN for unrelated bulk hosting. Money claims Synapse does not process payments. There are no donate or checkout buttons. The browser cannot forge raised totals or donation notifications. Off-site deals are your legal responsibility. Groups Owners can delete the whole group (posts and members cascade). Banned owners’ groups stay in storage but are locked — no enter, join, or chat. Identity One person, one account. No email addresses in display names. Impersonation gets suspended. Licensing & IP You keep ownership. The license on each project is the rule others follow. Use Report for copyright/IP complaints with work description, location, and contact details. How to report Safety: header flag / footer Report / profile Report. Feedback: header or footer Feedback. Appeals: footer Appeal (works after suspended accounts verify credentials once). Signed-in or appeal-session only. Do not publish other people’s private contact details. ## Legal Pointers — not a substitute for the full pages Full text elsewhere Terms of Service and Privacy Policy are the binding documents. This docs page explains the product; those pages govern the relationship. Accounts You are responsible for login security, 2FA, and activity from your account. Your files You keep ownership. Synapse hosts and shows what you publish so members can discover it under your license. Copyright complaints need work description, URL/ID, and contact info. No payments here Synapse is not a processor, broker, or advisor. Donation / interest UI is locked; the API rejects interest records and forged money notifications until a real ledger is turned on. Suspension & soft-hide Rule-breaking can mean a warning first, then timed bans or permanent. Soft-hide removes banned authors’ content from discovery without deleting storage. Appeal-only tokens cannot unlock the rest of the site.