Do you trust it by default? How do you know e.g. the import URL is the correct one and not going to an unrelated server?
Thinking about all the ways this can be abused
https://en.m.wikipedia.org/wiki/Slopsquatting
I'm wondering if you have any workflows here or thoughts on this.