> fetch, XMLHttpRequest : Nothing — these are the ones everybody checks. That's one of the things I don't like about security scanners, they just check for fet

> fetch, XMLHttpRequest : Nothing — these are the ones everybody checks. That's one of the things I don't like about security scanners, they just check for fetch and friends, and without context, they downgrade your security score. For example, I have a fully local client-server package that makes no external requests but it gets flagged with "Supply Chain Risk" because it uses `fetch`.