I don’t give it access to calls requiring API keys in the first place.

This is just good dev environment stuff. Have locally hosted substitutes for everything. Run it all in docker.