Synapse Platform Documentation

Synapse · SYN-DOCS · Last updated: 19 September 2026

Complete reference for accounts, publishing, supported file formats, security, sandbox behaviour and usage guidelines.

Getting started

First visit → useful account

Synapse is a members site for publishing projects, posting problems, joining groups, browsing Network posts (investor / company), and messaging other people. This instance does not process payments — there is no donate, checkout, or express-interest flow.

Create an account

Gmail + password (confirm a 6-digit email code) or Continue with Google.

Finish onboarding

Pick Developer, Investor, or Company. Set a public display name. You get a unique @handle and an 8-character profile ID.

Use the header

Create / Archive / Problems / Groups / Network / Messages. Turn on 2FA in Settings → Security.

Start publishing from Create. Discover work on Archive. Need the rules that bind the site? See Terms and Privacy.

Accounts & identity

What others see vs what stays private

Public profile

Display name, optional avatar & banner, bio, skills, @handle, and profile ID. URLs look like /u/yourhandle and /id/ABCD2345.

Email stays private unless you turn on “show email” in Settings. Unsafe display names are blocked on save; mild hits open a 1-day warning, severe hits can suspend immediately. Groups show a public ID like G-XXXXXXXX.

Account types

Developer — publish projects and problems.

Investor / Company — org profile, optional Network directory listing, verification request flow (review is operator-side). Payments stay locked.

Sign-in methods

Email accounts use a password (stored only as a bcrypt hash). Google accounts never share your Google password with Synapse.

Either kind can enable an authenticator app (TOTP) in Settings. You can list and revoke sessions from other devices.

Team / org helpers

Investor and company profiles can invite team members on the org card. Team roles are for collaboration on that profile — they do not bypass ownership of projects you personally created.

Projects & publishing

Creator Studio — what visitors actually get

Create is a multi-step wizard: basics → media & files → documentation → license & links → review. On media and later steps you get a live preview of the public page (hero / sandbox and docs) before you publish.

How files are attached

ZIP → stored as attachment URLs.

Folder upload → a browsable file_tree (junk folders like node_modules / .venv are skipped).

Loose files are fine for covers, videos, and one-off downloads. Default max is 300 MB per file, 1.2GB for video, and 300 MB for a 3D model (one per upload) — unless the operator changed these.

Format chips on Create are discovery tags (40+). See Files & previews for upload vs Synapse render vs download-only.

What visitors see

A display plan picks the hero (video, cover, gallery, interactive 3D, audio, or Synapse sandbox). You can override that in the wizard.

Overview renders Markdown docs. Files tab shows README (if present), the source tree, and downloads when you allow them.

HTML / JS are listed as source by default — a standalone .html file can also be opened with a "Run (sandboxed)" toggle, which plays it inside an isolated sandbox with no access to Synapse's cookies, session, or API. Installers (.exe/.msi/.apk) and archives stay download-only — they can never run inside Synapse at all, only after you download and install them yourself.

License & comments

You keep ownership. The license you pick is what others may do with that work — choose carefully (license index).

Comments can be turned off per project. When on, threads appear under Discussion with types like feedback, question, and bug report.

Draft vs published

Save draft or publish from the last step. Edit later with /create?edit=… from your project page when you are the owner.

Synapse does not process payments. A listed price or “looking for investors” tag is discovery only.

Write-ups & Markdown

What “Copy Markdown link” is for — and what actually renders

Every public project has an About write-up. You type it in Create (or optionally override with a chosen .md file). That text is Markdown: headings, lists, tables, images from your files, #tags, and diagrams. Raw HTML and JavaScript in a write-up are not executed.

Copy Markdown link (the ⋮ menu)

On a post such as CodeMind-architecture-AI, the kebab copies a snippet like [CodeMind-architecture-AI](…/project/…).

What it is for: paste that into another project’s write-up, a README, a group post, or a comment. Synapse turns the title into a clickable chip (labeled Project) that opens that post in the app — not a raw website address.

What it is not: it is not a download, not a license grant, not an embed of the other project’s files, and not a secret admin URL.

Copy page link vs Markdown link

Copy page link — a normal URL for chat, email, or another website.

Copy Markdown link — the title plus URL in Markdown form, for write-ups and comments on Synapse (and any other Markdown editor that understands [text](url)).

What you can write

Headings with ##. Lists and tables. Images that point at files you uploaded. #LLM-style tags that link to Archive search.

Diagrams: a fenced block starting with mermaid (flowcharts, sequence, class, and similar). Synapse draws them in the sandbox theme.

Same-site links to projects, problems, groups, and profiles stay inside the app. Off-site http(s) links open in a new tab and are checked so javascript: URLs never become buttons.

Where it shows up

Overview on the public post, README in Files when you pick one, comments and replies, Network posts, group posts, and problem write-ups.

Comments: paste the Markdown snippet and it becomes a Project chip with the title you copied — so a name like CodeMind-architecture-AI is the label, not a hostname.

Problems, groups, Network & investors

The rest of the product, as it ships today

Problems & workspace

Post a problem with files, then open the in-browser workspace to edit text, preview media, and keep revision history of saves. Formal solutions live under Solutions; Discussion is for questions and hints. Collaborator saves can ping the owner (Settings → Workspace edits).

Groups

Create or join a group, post in the feed, reply in threads. Each group gets a short public ID (G-XXXXXXXX). Owners manage members and settings. Joining someone else’s group can notify the owner, and new members appear in the member list at once. Unsafe group names are blocked on save. Owners and site admins do not delete other people’s posts: they remove them with a written reason. The author gets a bell notification with that reason and still sees the post greyed out (and can edit it); everyone else no longer sees it, and a moderator can restore it.

Network posts

Investor / company posts (jobs, RFPs, etc.) use a full-page editor with scheduling when allowed. Public detail pages render Markdown. Verification is a request + operator review — not a paid badge store.

Direct messages

One-to-one chat. Conversations refresh by short polling (and push when the connection allows). You can edit or delete your own messages. Blocking stops new DMs both ways. Message alerts respect Settings → Messages.

Follows

Follow other members. Follower / following lists live on each profile. A new follow can notify the person you followed, unless they turned Follows off in Settings.

Investors page

Pipeline of posts marked as seeking capital, plus signals you sent or received. Charts are activity snapshots. Payment buttons stay locked; reported “raised” figures are not escrowed money.

Notifications

The bell lists follows, likes, comments, messages, group joins/mentions, and workspace edits. Filter on the full inbox. You can turn each category off in Settings. You are never notified about your own actions.

Money features (locked)

Donation and express-interest buttons are disabled platform-wide. Figures on a project are not live balances. Any real money talk is off-site and your responsibility under the law that applies to you.

Views, likes, comments & alerts

How counts, discussion, and the bell behave

Views (YouTube-like, not forever-once)

Opening a project or problem page records a view. The same browser can count again after a short cooldown (about 20 seconds) so refreshes do not spam the counter, but returning later still increments.

Viewers are identified with a small session cookie (synapse_vid), not by “logged-in user may only ever count once.” Different browsers / devices count separately.

Counts on cards and detail pages stay in sync across the site via a lightweight live feed (and short polls when push is unavailable).

Likes

Likes require sign-in. Toggling like updates the count for everyone watching that item. There is no separate analytics product or third-party tracker.

Comments

On projects (when enabled) and problems, comments support types, replies, likes, edit/delete of your own posts, and optional pasted images.

Paste a Markdown link copied from another post — it becomes a titled Project chip, not a hostname. #tags link to Archive search.

New comments show up for others within a few seconds (poll backup if live push cannot connect).

Notifications (bell)

Follows, likes, comments, messages, group joins/mentions, and workspace saves. The dropdown is a short preview; /notifications is the full inbox with filters.

Each category has a switch in Settings. System notices (warnings, suspensions) still arrive. Duplicate pings from the same action are folded so the bell stays light.

What views are not

Not ad impressions, not a paid ranking product, not sold to advertisers. Operators may use aggregates for moderation and capacity — not for selling your browsing history.

Automatic safety (names & content)

Profile names, handles, group names, project/problem titles, Network post titles, org firm/company names, comments, group posts, and messages are checked on every save.

Mild / general hits: warn first (1–2 day fix window), then escalate if still unsafe. Severe hits (hate, threats, sexual, scam, child-safety): immediate suspensionwith durations based on severity (including permanent). A background scan also scrubs legacy bad labels.

Files & previews

57+ Create tags · three different meanings of “supported”

“Supported” on Synapse is not one switch. Create’s format chips are discovery tags(57 options today) — they describe what is in the project. Separately, the upload API accepts almost any project file (default 300 MB for most files, 1.2GB for video, and 300 MB for a 3D model — one model per upload). Preview is a third story: only some extensions go through Synapse’s own renderers; the rest still upload and download.

1 · Upload / store

Bytes land on disk or object storage. Only a tiny set of browser page types is blocked (.xhtml, .shtml, .swf, .hta). HTML/JS/SVG still upload for IDE use but are served as text so they cannot run as pages.

2 · Synapse render

Our gallery, video/audio players, PDF embed, Three.js 3D (GLB/GLTF/OBJ/FBX/STL), and the custom sandbox (RTL maps, SPICE, Markdown, highlighted code).

3 · Download-only

Installers, archives, CAD packages, Blender, Unity packages, spreadsheets, and many other tags — listed in the tree / downloads, opened with your tools.

How Synapse’s preview pipeline works

Opens with Synapse’s own viewers (gallery, video, audio, PDF, interactive 3D).

Processed by Synapse’s post sandbox — hardware maps, circuits, docs, highlighted code.

Also previewed (beyond Create tags)

AVIF / HEIC / BMP / ICO — Image gallery when decodable.

MKV / M4V / AVI — Video if the browser can play the codec.

M4A — Audio controls.

YouTube URL — Embedded via youtube-nocookie.

Sandbox extras (folder / IDE files)

V / SV / VHDL / VHD — RTL → Synapse hardware module map + source.

CIR / SPICE / SP / SCH — Circuit netlist → Synapse circuit summary + source.

PY / RS / GO / JAVA / C / C++ / … — Syntax-highlighted code pane (many languages).

YAML / XML / TOML / TSV — Data / config text preview.

MDX / RST / ADOC — Document-style text / markdown family.

Labels: Renders in Synapse · Synapse sandbox · Source / text preview · Upload & download. Interactive 3D today = GLB, GLTF, OBJ, FBX, STL. Other 3D tags still upload.

Speed, cache & storage

Why pages should feel light — without listing servers

One origin, hashed assets

The public site and API share one host. JavaScript/CSS filenames include a content hash and are cached for a long time. HTML is not cached, so a deploy shows up on the next visit.

Compression

API and page responses are compressed when the browser asks. Live stats streams are left uncompressed so they are not delayed.

Uploads

Files land on this instance’s disk, or object storage if the operator configured it. Unique filenames can be cached hard. There is no public “list the whole bucket” page. Synapse does not recompress 3D or re-encode video for you.

Size & junk filters

Default 300 MB per file (1.2GB for video, 300 MB for a 3D model). Folder uploads skip dependency / virtualenv junk. Oversized or unreadable uploads are rejected.

Live counts without hammering

Views, likes, and comments use a short-lived connection when it works, and slower polling when the tab is visible. Hidden tabs do not keep polling. The home marketing block does not fade in from invisible, so the page does not bounce twice.

Images in the tab

Images you already loaded can be reused in the same visit. That is a local convenience cache, not a tracker.

No money pipeline

Uploading does not start payouts, invoices, or escrow.

What we do not publish here

Operator machine addresses, internal hostnames, and database locations stay off this page. Public traffic uses HTTPS at the edge of this instance.

Reports, warnings & appeals

How members escalate problems — and how suspensions work

Three public channels (footer + header where shown): safety reports (harassment, hate, scams, impersonation, threats, sexual content), site feedback (bugs and ideas), and appeals (challenge a suspension with your side of the story). Safety and feedback require a normal signed-in session. Appeals also work after a suspended account verifies email/password or Google once — that unlocks a short appeal-only session (not full site access).

Up to four screenshots. Empty spam is rejected. Filing is rate-limited. Bad public names/content are blocked on save — you do not wait for someone else to file a report. Mild cases warn first (1-day fix window); severe cases suspend immediately. Ban durations used by operators and automation: 1 / 3 / 7 / 14 / 30 days or permanent. Evidence is stored on the ban record so appeals are reviewed against facts, not as a black box. A suspended account cannot use the rest of the site until the ban ends or an operator lifts it. Posts, comments, and related public content from a suspended account are soft-hidden (kept in the database, removed from feeds/search/chat) — not deleted. Direct messages with that account are blocked while the ban is active.

Discovery uses a 5-level trust ranking (Restricted → Caution → Standard → Established → Trusted). Clean, established accounts rank higher in search and feeds. Warnings step trust down; bans force Restricted. Trust recovers slowly after clean time (about a week) once warnings expire and the ban is lifted.

Payments, donations & sales

Powered by Stripe — cards and bank details never touch Synapse

Synapse lets members give to a project or problem, and sell a project at a fixed price. Stripe processes every payment; Synapse keeps only a receipt record. Legal detail: Terms → Payments and Privacy → Payments.

Paying accounts

Add up to 7 credit or debit cards (Visa, Mastercard, American Express, JCB, Discover, UnionPay, Diners). Name and billing address come first, then the card in Stripe’s secure form. Up to 5 can be switched on at once; the same card can’t be added twice to one account.

Receiving accounts

Up to 5 Stripe Connect accounts. Stripe verifies your identity and pays out to your bank — Synapse never sees bank details. A project chooses one account for donations and another for sales.

2FA gate

Payment settings open only after a fresh authenticator code (or a GitHub check, if GitHub’s 2FA is your second factor), and lock again when you leave the page. Every payment also needs an active unlock. No 2FA yet? A lock box takes you straight to Settings → Security.

Paying

Press Donate or Buy, choose which switched-on account to pay from, confirm the amount, accept the payment terms and pay. 3-D Secure challenges are handled by your bank. A PDF receipt is emailed and kept under Settings → Payments.

External funding links

GitHub Sponsors, GoFundMe, Kickstarter, Indiegogo, Open Collective, Patreon, Ko-fi, Buy Me a Coffee and Liberapay links can be shown on a project. They leave Synapse; those sites handle the money.

What is not offered

No equity fundraising, escrow or bounties. Investor profiles are introductions only. Totals on a project come from confirmed payments and can’t be edited.

AI & data access

You decide, category by category — everything starts off

Settings → AI & data has 14 switches: allow everything, titles & posts, descriptions, source code only, code with documentation, images only, video only, audio only, 3D only, documents, hardware files, comments, public profile, and tags & statistics. All are off until you turn them on; turning one off resets it.

What crawlers get

Well-behaved AI crawlers identify themselves and receive only the categories the author allowed. With nothing allowed they get HTTP 403 and a noai signal. A scraper that hides its identity can’t be stopped by any website.

Open documents

Privacy, Terms, licenses and this documentation are open to everyone, including AI systems, as full plain text: /llms.txt, /llms-full.txt and /ai/*.md, plus official PDFs under /legal/.

Evidence requests

Ten days after you switch a category on, you can ask for a written statement with supporting files that only permitted data was accessed. It goes straight to the operator console; the answer arrives by email and in-app, with a download button.

Reset

Switching a category off deletes its record and its 10-day clock at once. Nothing is remembered from before.

Security — full picture

Server, browser, uploads, and what you still control

Written to match the live stack (Express + Helmet + Postgres, Vite/React front end). Legal wording lives in the Privacy Policy.

Hardening in force

Accounts & sessions

Passwords & Google

Email passwords are stored only as bcrypt hashes — Synapse cannot show them back. Google sign-in never receives your Google password. Your session lives in an HttpOnly cookie the browser sends automatically — no page script, extension, or injected code can read it, and it's cleared on logout.

Two-factor (TOTP)

Optional, and one definition everywhere: an authenticator app set up under Settings → Security, or GitHub’s own two-factor if your account is linked to GitHub. Secrets sit in a dedicated table, separate from the public profile. Once on, changing your @handle, opening Payments and opening the developer tools (API keys, sign-in apps) all ask for a fresh code. No 2FA yet? Those screens simply point you to Settings.

Revocable sessions

Each sign-in creates a server session ID. Logout or “revoke device” invalidates that session on the API immediately — closing one tab is not enough if you leave another device signed in. Settings → Security → Active sessions can sign out one device, all other devices, or everywhere: “everywhere” includes the device you are on, so everyone, you included, signs in again.

Rate limits

Login, signup, password reset, reports, uploads, and owner-console unlock slow down after repeated hits. This is abuse control, not a hidden reputation score.

Server (API & storage)

Private fields stay private

Email (unless you publish it), payout notes, notification prefs, and similar fields are returned only to the owner. Other members receive the public profile shape only.

Ownership on every write

You cannot grant yourself admin from DevTools. Project/problem edits check ownership. Likes and views only move through dedicated actions — not by patching a JSON counter.

Upload hardening

Almost any project file can be uploaded. Only a few browser-executable page types are blocked. HTML/JS/SVG still upload for the IDE but are served as text/plain + nosniff so they cannot run as pages. Default size cap 300 MB per file (the operator can lower it).

How files are served

Files are served through Synapse routes, not as a public bucket listing. HTML/JS/SVG/CSS are sent as plain text with nosniff so a direct link never runs as a page on Synapse's own origin — the only way to run an .html file at all is the opt-in sandbox described below.

URL & media sanitization

On create/update, media and link fields are filtered to http(s) or trusted upload paths. javascript: and similar schemes are rejected before they are stored.

View cookie

A first-party HttpOnly cookie applies the short view cooldown per browser. It is not an advertising ID and is not sold.

No payment processor

Donate, checkout, and investor-interest writes are rejected. Raised totals cannot be forged from the browser. Off-site deals are between members.

Browser origins

Cross-site browser calls to the API are limited to this instance’s allowed front ends. Unknown sites cannot ride your session from another origin.

Browser & front end

HTTPS & security headers

Public instances sit behind HTTPS. The API sends Helmet headers, a Content Security Policy, and a permissions policy that does not ask for camera, microphone, location, or in-browser payments.

Content Security Policy

CSP defaults to same-origin scripts, blocks object embeds, and forbids framing the app in other sites. Dangerous schemes such as javascript: in media are blocked in the browser even if bad data slipped through.

Markdown & comments

User Markdown is rendered without running raw HTML as a site. Link destinations are checked so javascript: URLs do not become clickable actions. Same-site project links show the copied title, not a server hostname. Diagrams and charts take the room they need in the page — nothing is locked to a fixed height. They open full screen only with the expand button; full screen is a free canvas (drag in any direction, scroll to move, Ctrl + wheel or pinch to zoom, double-click to zoom in or fit) and closes with the X or Esc.

Web sources: source by default, sandboxed if you ask

HTML / JS / CSS / SVG open as highlighted source (or plain text) by default — nothing runs automatically just from opening a project. A standalone .html file adds a "Run (sandboxed)" toggle that plays it inside an isolated frame with its own scripting-only permissions: no cookies, no session, no calling Synapse's API, no reaching the rest of the page. It never runs as a live app on Synapse's own origin.

3D & media viewers

The Three.js viewer and media players load only http(s)/upload URLs the app already accepted. They are not a general “run arbitrary plugins” surface.

What you should still do

Unique password, turn on 2FA, never paste secrets into public files, and report impersonation early. No stack is perfect — see Privacy for breach language.

Threat model in one line

How the site talks to itself — and to your own tools

Same-origin /api for the React app, plus a real developer API

The React app calls /api on the same host with your session — editing data in DevTools cannot invent permissions, since the server checks ownership, session validity, bans, and rate limits on every write.

Separately, there is a public developer API: account keys for posting from scripts, CI or an AI agent; a stateless email + password exchange with no key at all; and a "Sign in with Synapse" OAuth 2.0 flow for other sites. Full reference, request/response shapes and rate limits live on one page rather than repeated here — see the developer dashboard.

Developer tools need two-factor. The page checks your real account: an authenticator app set up in Settings → Security, or GitHub's own two-factor if your account is linked to GitHub. With neither, the page shows a lock box that takes you to Settings to set it up. With one of them, a centered window asks for the 6-digit code (or sends you to GitHub to verify) before anything is shown. The unlock lasts 15 minutes, ends with "Lock now", and ends when you leave the page. Creating or revealing a key and creating a sign-in app are enforced on the server with the same rule, not just hidden in the page.

Live-feeling updates (views, likes, comments, feeds) use a mix of short polling and optional push channels. If a live connection cannot be established, the site falls back to polling and a stats stream so counts and comments still move.

Pages are built to survive bad connections: a read that fails because of a dropped connection, a stalled request, a restarting server or a half-sent answer is retried (0.4 s growing to 8 s) until it succeeds instead of leaving an empty screen; a page script that fails to download is retried and then reloaded; and if the app has not appeared after 20 seconds it reloads once and then offers a Reload button.

Usage guidelines

Practical rules that keep the archive useful

Content you upload

Only publish work you own or have rights to share under the license you pick. Credit originals on derivatives. Stolen, illegal, or abusive material can be removed and accounts suspended.

File size & honesty

Stay within the per-file cap. Do not upload malware, credential dumps, or scrapers. The site stores what you send — it is not a free CDN for unrelated bulk hosting.

Money claims

Synapse does not process payments. There are no donate or checkout buttons. The browser cannot forge raised totals or donation notifications. Off-site deals are your legal responsibility.

Groups

Owners can delete the whole group (posts and members cascade). Banned owners’ groups stay in storage but are locked — no enter, join, or chat.

Identity

One person, one account. No email addresses in display names. Impersonation gets suspended.

Licensing & IP

You keep ownership. The license on each project is the rule others follow. Use Report for copyright/IP complaints with work description, location, and contact details.

How to report

Safety: header flag / footer Report / profile Report. Feedback: header or footer Feedback. Appeals: footer Appeal (works after suspended accounts verify credentials once). Signed-in or appeal-session only. Do not publish other people’s private contact details.

Legal

Pointers — not a substitute for the full pages

Full text elsewhere

Terms of Service and Privacy Policy are the binding documents. This docs page explains the product; those pages govern the relationship.

Accounts

You are responsible for login security, 2FA, and activity from your account.

Your files

You keep ownership. Synapse hosts and shows what you publish so members can discover it under your license. Copyright complaints need work description, URL/ID, and contact info.

No payments here

Synapse is not a processor, broker, or advisor. Donation / interest UI is locked; the API rejects interest records and forged money notifications until a real ledger is turned on.

Suspension & soft-hide

Rule-breaking can mean a warning first, then timed bans or permanent. Soft-hide removes banned authors’ content from discovery without deleting storage. Appeal-only tokens cannot unlock the rest of the site.