My Website's API Was Flagged as Phishing–and I Still Don't Know Why (opens in new tab)

I fear a future where we are all Archibald Buttle [0], at the whim of implacable systems that will eventually ruin our lives with no explanation or appeal, because nobody really cares about doing the right thing.

I suspect there's some overlap to how prior generations had internalized anxieties about nuclear armageddon.

[0] https://en.wikipedia.org/wiki/Brazil_(1985_film)

I've seen similar with AWS where an API endpoint got flagged for "suspicious traffic patterns" just because it was serving webhooks at irregular intervals. The appeal process took weeks and nobody could explain what triggered it. Firebase's tooling for this stuff feels like a black box.

Last Saturday Google Cloud / Firebase suspended my website’s API (metrics.chrisvogt.me) as a phishing site. I’m on a backup a week later with no explanation and no response to my appeal. Here’s what happened and what I’m doing next