blah.supabase.co/rest/v1 request failing

Bug report

Describe the bug

Both on the Supabase dashboard (app.supabase.com) and our apps, requests to instance-id.supabase.co/rest/v1 are failing.

This is happening on both Supabase organizations I am a part of.

To Reproduce

Attempt to send any request to `instance-id.supabase.co/rest/v1.

Expected behavior

I expect requests to the supabase postgrest instance to be successful.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: MacOS
• Browser (if applies) Firefox

Additional context

[inian]

Another update - Supabase domains have been accepted into the Public Suffix List. Over the next few days, we will be offering an alternate domain for affected users. Everyone affected please reach out to [e-mail] referencing this issue and I will set you up the alternate domain right away.

[kiwicopple]

Hi all, the investigation is still ongoing but we have some updates. This was caused by user who signed up to host malicious content on Supabase storage. We took down the content within an hour and blocked the account - it looks like they were a very new GitHub account created specifically for this

We worked closely with our contact at Google to clear the subdomain: https://transparencyreport.google.com/safe-browsing/search?url=supabase.co

We are taking steps to mitigate this:

• We are adding supabase.co to the Public Suffix List which would indicate any site under supabase.co are to be treated as separate websites
• We are limiting Storage Hosting to a small subset of content types (we will even block HTML hosting until we are certain we can manage malicious actors at scale)
• We will implement support for custom domains so that you are not impacted by other users on the platform
• We’ve setup an [e-mail] email to receive notifications when we receive abuse reports from upstream providers
• We will block suspicious Github accounts from creating new projects until they have been reviewed by a team member