fetch() allows HTTPS by default. Network policy can be tightened or extended
with global flags or their configuration equivalents:
--fetch-allow-scheme <SCHEME>--fetch-allow-host <HOST>--fetch-block-host <HOST>--fetch-default-deny
Host patterns may contain wildcards such as *.example.com. A block rule wins
over an allow rule. --fetch-default-deny permits only explicitly allowed
hosts.
Avoid placing secrets in URLs. Netsuke logs hosts and cache keys rather than complete URLs, but downloaded content and commands still run within the host trust boundary.