Restrict Deno to write to stdout only, read stdin and main.js only.
diff --git a/dev/run b/dev/run
index 3d5b3d7..4919ab0 100755
--- a/dev/run
+++ b/dev/run
@@ -686,8 +686,8 @@
qs_javascript = toposixpath("%s %s" % (couchjs, mainjs))
qs_coffescript = toposixpath("%s %s" % (couchjs, coffeejs))
- qs_deno = toposixpath("%s %s" % ("deno run --allow-write", denojs))
-
+ deno_cmd = f"deno run --allow-write=- --allow-read=-,{denojs}"
+ qs_deno = toposixpath("%s %s" % (deno_cmd, denojs))
os.environ["COUCHDB_QUERY_SERVER_JAVASCRIPT"] = qs_javascript
os.environ["COUCHDB_QUERY_SERVER_COFFEESCRIPT"] = qs_coffescript
