If you provide infrastructure that hosts applications for developers, you will eventually run into network blocks. ISPs, national firewalls, and automated abuse systems can block IP ranges or domains with little warning. When you operate a multi-tenant platform, a single abusive workload can affect thousands of unrelated developers.
For infrastructure providers, this creates a difficult balance: you need to keep the platform open and flexible for developers while preventing behavior that can trigger regional blocks.
At Supabase, we’ve encountered this several times ourselves and in this post we share lessons from three real incidents, what caused them, and the steps we took to resolve and prevent them. In each case, local ISPs or government authorities had blocked access to supabase.co domains.
The goal is to help other infrastructure providers understand how these blocks happen and how to respond when they do.
Multi-tenant platforms often host applications on subdomains like project.example.com. Without additional safeguards, browsers treat all of these as part of the same site, which can create security and reputation risks across tenants.
