Forking a project *occasionally* generates a pseudo-random sub-domain name that starts with a digit.

🐛 bug report

Preflight Checklist

• I have read the
  Contributing Guidelines
  for this project.
• I agree to follow the
  Code of Conduct
  that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want
  to file, without success.

Description of the problem

I use codesandbox a lot in developing Firestore-based React apps, and ran into an "interesting" issue. When Codesandbox forks a project, it generates a pseudo-random domain to allow for testing - so, you may see the project called lumininous-fraternity-df7gxk, and the built app will deploy at df7gxk.csb.app .

Where it gets fun is sometimes the generated sub-domain will START with a digit - for example, 2omvk.csb.app (real case)

According to the RFC 1034 standard, domains:

must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphen. There are also some restrictions on the length. Labels must be 63 characters or less.

In practice, many browsers and other user agents support domains that start with a number. My personal take is this falls into a grey zone as to whether it's a bug or not. Firebase Auth is requiring a "valid" domain name, but some "invalid" domain names appear and can be used in practice.

I found out the hard way that Firebase Auth does NOT accept that as a sub-domain. the exact same code, forked again so that the sub-domain does not start with a digit, works fine.

Easy fix, obviously, just fork again. But it took a bit of sleuthing (and, well, 40 years of experience with weird problems) to speculate that that was the problem, and try the solution.

How has this issue affected you? What are you trying to accomplish?

About two hours of staring to see "something is not right" until solution was suspected and tested.

To Reproduce

Whelp, since it's pseudo-random, kinda hard to force it. I have a highly confidential sandbox that currently has this issue; I suspect codesandbox people can kinda force it if they try.

Link to sandbox: link (optional)

Sadly, highly confidential

Your Environment

No source file or test is named. Start by tracing the fork flow and the pseudo-random subdomain generation, then check how generated labels are validated; done means generated subdomains no longer begin with a digit and the behavior is covered by a reproducible test.