so the fetch is protected, but i'm guessing the additional bootstrap steps are not.