[xrd]

With deno you need to manually specify if you want to permit internet access:

deno run --allow-net=xyz.com,abc.com

If you run without a domain, it allows access to all. Seems like it should be more explicit by default, perhaps there is a config option.

Speaking of config options, I wonder if there is a config option to prohibit access to domains like pastebin.org no matter what. Seems like an arms race that an attacker could circumvent, but maybe they won't bother and will only attack my dumber friends.