Domain allowlist is in: NEOBROWSER_DOMAIN_ALLOWLIST=github.com,.docs.rs — navigate rejects anything not listed with an error that names the allowed hosts. Exact hosts or .suffix, opt-in (unset = no restriction). Appreciate the push on this one.