I should also mention that Firebase does let you run trusted code if you want to -- you can run a server as a Firebase client using our Node.js library or using our REST API. Then you can do anything you would normally do with a server, and still get Firebase's real-time updates.

The model is reversed in this case though, where instead of clients talking to your application server, clients talk to your database (Firebase), and your application server only ever talk to your database (Firebase). It's a bit of a conceptual shift, but we have many customers doing this in production and it works quite well.