Roadmap
What Vaultbase is building next, what comes later, and what it won't do.
Where Vaultbase is headed. Until 1.0 this is a plan, not a promise: the order and the contents can change at any time. There are no dates: each item ships when it is ready, and the changelog records when it did. To ask for something, or to argue for a different order, start a discussion in Ideas. Bugs go in Issues.
The aim for this year: a complete backend for apps of any size you’d build on one server, reliable enough to run in production.
Features
Section titled “Features”- Repeatable group fields: a field that holds a list of small structured items (an address book, line items), validated and filterable.
Dart / Flutter SDK
Section titled “Dart / Flutter SDK”A first-party SDK for Flutter and Dart: records, auth, files, realtime and generated types, like the JavaScript SDK.
Postgres out of beta
Section titled “Postgres out of beta”Postgres shipped as beta in 0.23.0. Before the label goes:
- A move tool that copies an existing SQLite install to Postgres, records and files.
- Restore from the admin UI on Postgres. Today it points you to
pg_restore. - Postgres figures on the Performance page, measured the same way as SQLite’s.
Getting started
Section titled “Getting started”- Deployment recipes for a plain VPS, behind Cloudflare, and on Postgres. The Docker image and templates for Render, Fly.io and Railway shipped in 0.26.0.
- A video quick start and example apps to start from.
Plugins
Section titled “Plugins”Code that embeds Vaultbase can already register field types, sign-in providers, storage drivers, email transports, push providers, hooks, routes and jobs through the extension points. The binary runs hooks and routes written in the admin UI or kept as files, but it can’t load a plugin. Plugins bring the extension points to the binary:
- A plugin package: one file holding a manifest and the plugin’s code, installed from the command line and enabled or disabled without a restart. Disabling a plugin removes everything it registered.
- A local plugin folder that reloads on save, for writing your own.
- A Plugins page in the admin UI: upload, settings, errors.
- Signed packages. A plugin runs inside the server with the same access as a hook, so only admins can install one, and the install screen says so.
- Every server gets it: on Postgres, a plugin installed through one server reaches the others sharing the database.
Faster deep pages
Section titled “Faster deep pages”A list page far into a large collection makes the database step over every record before it, so page 3,000 costs far more than page 1. Vaultbase will remember positions in large sorted lists, so a deep page starts close to where it lands. Cursor pagination follows, for apps that walk a whole collection.
More SDKs
Section titled “More SDKs”Python, Go, and native Swift or Kotlin clients.
Sign-in and uploads
Section titled “Sign-in and uploads”- Passkeys (WebAuthn).
- Captcha (Turnstile or hCaptcha) on sign-up, sign-in and password reset.
- Resumable uploads (TUS) for large files on poor connections.
Operations
Section titled “Operations”- Uploaded files in backups. With local storage, scheduled backups cover the database only today.
- Time limits on hooks, routes and jobs, so one runaway script returns a clear error instead of holding the server.
- Maintenance mode: take the API offline for clients while admins keep working.
- Parameters on view collections.
- The compiled binary tested on every platform it ships for, and browser tests for the admin UI.
- Vaultbase Cloud: a hosted option for people who’d rather not run a server. Self-hosting stays first-class; Cloud sells convenience, not features.
- A plugin marketplace: browse and install plugins from the admin UI, published by their authors.
- Sandboxed plugins: a plugin that runs in its own worker with only the access its manifest asks for.
- Realtime at a larger scale: presence and broadcast channels.
- Migration files kept in git and replayed in CI.
- SSO (SAML) and organisations.
- Continuous replication and point-in-time restore for SQLite.
- The admin UI in other languages.
- More sign-in options: several OAuth accounts per provider, and SMS sign-in.
- Removing
vaultbase cluster. It has been deprecated since 0.22.0: read worker threads use every core from one process, and several servers can share one Postgres database. It will go in a later minor release, with an upgrade note. Cluster mode won’t get cross-worker realtime; read workers and servers sharing Postgres already deliver every change to every subscriber.
Not planned
Section titled “Not planned”- Multi-region deployments and sharding.
- 100,000 or more concurrent connections on one server.
Recently shipped
Section titled “Recently shipped”| Version | Date | What |
|---|---|---|
| 0.27.1 | 2026-10-22 | Read workers rebuild their settings caches once a changed value has reached them (rate limits could stay stale for 5 s) |
| 0.27.0 | 2026-10-22 | Read workers accept connections themselves on Linux; unfiltered list totals from a stored row count; search newest first unless sort=@rank; worker-served reads rate-limited again |
| 0.26.5 | 2026-10-20 | Relation fields indexed automatically (a post’s comments: 56 ms → 1.2 ms); realtime over the cap refused before the upgrade; indexed fields drop and rename cleanly |
| 0.26.4 | 2026-10-20 | An admin UI pass: record history and restore, flag segments, webhook redelivery, theme colours; settings validated at save; log search that sees every entry |
| 0.26.3 | 2026-10-19 | Security fixes from checking the docs against the code: rules on missing values, stale list totals, audit coverage, backup cleanup; API tokens as documented; every docs page corrected |
| 0.26.2 | 2026-10-19 | Upload files from the admin’s record form, modals and drawers in the new design, singleton updates over realtime for everyone who can read them |
| 0.26.1 | 2026-10-19 | Get one record with expand and fields |
| 0.26.0 | 2026-10-19 | An HTTP client in the admin with export, a shorter sidebar with favorites, an official Docker image and host templates |
| 0.25.0 | 2026-10-18 | Singleton collections, every email template editable, realtime fan-out that can’t stall the server, tested upgrades |
| 0.24.1 | 2026-10-18 | Slow WebSocket clients are disconnected instead of growing memory |
| 0.24.0 | 2026-10-18 | Fixes from a technical review: permissions, batches, unique jobs, live restore, multi-server Postgres; /_/ready |
| 0.23.2 | 2026-10-18 | Read workers are replaced automatically after an overload |
| 0.23.0 | 2026-10-16 | Postgres (beta), several servers on one database, helpers.sql |
| 0.22.0 | 2026-10-15 | Record reads on worker threads by default |
| 0.21.0 | 2026-10-15 | List queries on the Monitoring page, composite indexes |
| 0.20.0 | 2026-10-14 | Monitoring page, writes that share commits |
| 0.19.0 | 2026-10-13 | Extension points, event bus, hooks as files |
The changelog has every release in full.