[whizzter]

If security principles are important they should be on a deny-default basis with allow-lists rather than the other way around.

If the deno runtime implements the fetch module itself, then post-resolution checking definitely should be done though. It's more of an bug though than a principled security lapse.

[bugtodiffer]

The thing is that this applies to all parts of the sandbox https://secfault-security.com/blog/deno.html