Never promise "no network requests"

> fetch, XMLHttpRequest : Nothing — these are the ones everybody checks.

That's one of the things I don't like about security scanners, they just check for fetch and friends, and without context, they downgrade your security score.

For example, I have a fully local client-server package that makes no external requests but it gets flagged with "Supply Chain Risk" because it uses `fetch`.