Deno scripts need explicit permissions

deno run --allow-net=api.example.com --allow-env main.ts

Scoping the flag, like --allow-net=host, keeps the grant small.