Deno --allow-net host allow-list does not restrict server bind address

Deno's --allow-net flag accepts an optional comma-separated host:port allow-list (since v1.9) that restricts which remote addresses a process may connect to or accept connections from. However, the flag does not validate or constrain the address passed to Deno.listen(). A server can bind to 0.0.0.0:8000 while running with --allow-net=127.0.0.1:8000; the process starts successfully, but inbound connections from non-localhost sources are rejected at the syscall layer.

This separation between bind-time and connect-time checks creates a configuration gap: the listen address is effectively unvalidated, so a typo or copy-paste error in the bind string does not produce a permission error at startup. The documentation recommends binding to 127.0.0.1 explicitly, but that remains a convention rather than an enforced constraint. There is also no runtime API to inspect the effective network permission set after startup.

What are the intended threat-model assumptions behind allowing a bind address outside the allow-list? Are there plans to add a startup validation that warns or errors when Deno.listen() is called with an address not covered by the active --allow-net host list? Can the permission prompt (--prompt) be made to trigger at bind time instead of first connection?