Node built in fetch dont reject unauthorized - How to handle self-signed certificates? or Why does no

Yep, node built in fetch dont reject unauthorized certs by default. It’s a trade-off for dev flexibility, but yeah, risky in prod.

To enforce checks:

```javascript
const https = require('https');
const fetch = require('node-fetch');

const agent = new https.Agent({ rejectUnauthorized: true });
await fetch('https://example.com', { agent });
```

If you’re using native fetch in newer Node, same idea—just pass the agent.

Kinda annoying this isn’t the default, tbh.