Here's the set of new deny flags, which have higher precedence over allow flags:
--deny-env=<VARIABLE_NAME>
--deny-sys=<API_NAME>
--deny-hrtime
--allow-net=<IP/HOSTNAME>
--deny-ffi=<PATH>
--deny-read=<PATH>
--deny-run=<PROGRAM_NAME>
--deny-write=<PATH>
Learn more here: https://deno.land/manual/basics/permissions