[wcarss]

That's reasonable. :)

Those things should already require authorization to access their streams, and your creds for e.g. meet.google.com shouldn't be available in other tabs/windows at other domains to send along, but it still would likely be reasonable to default to preventing access to/from domains unless they are marked as safe, in much the same way accesses are already requested/allowed.

I acknowledge that a feature like that would take real work to write and support and keep secure, but control over access to data should be the user's choice, not the server's.