diff --git a/README.md b/README.md
index 5d0fb8f..cf44507 100644
--- a/README.md
+++ b/README.md
@@ -81,6 +81,9 @@ The default options (as defined in [lua/config.lua](./blob/main/lua/gh-actions/c
   refresh_interval = 10,
   --- How much workflow runs and jobs should be indented
   indent = 2,
+  --- Allowed hosts to fetch data from, github.com is always allowed
+  --- @type string[]
+  allowed_hosts = {},
   icons = {
     workflow_dispatch = '⚡️',
     conclusion = {
diff --git a/lua/gh-actions/config.lua b/lua/gh-actions/config.lua
index 90a3ddf..f88a8ff 100644
--- a/lua/gh-actions/config.lua
+++ b/lua/gh-actions/config.lua
@@ -7,6 +7,9 @@ local defaultConfig = {
   refresh_interval = 10,
   --- How much workflow runs and jobs should be indented
   indent = 2,
+  --- Allowed hosts to fetch data from, github.com is always allowed
+  --- @type string[]
+  allowed_hosts = {},
   ---@class GhActionsIcons
   icons = {
     workflow_dispatch = '⚡️',
@@ -73,6 +76,8 @@ function M.setup(opts)
   opts = opts or {}
 
   M.options = vim.tbl_deep_extend('force', defaultConfig, opts)
+  M.options.allowed_hosts = M.options.allowed_hosts or {}
+  table.insert(M.options.allowed_hosts, 'github.com')
 end
 
 return M
diff --git a/lua/gh-actions/init.lua b/lua/gh-actions/init.lua
index 1c0455f..02b32eb 100644
--- a/lua/gh-actions/init.lua
+++ b/lua/gh-actions/init.lua
@@ -19,6 +19,18 @@ function M.setup(opts)
   require('gh-actions.command').setup()
 end
 
+local function is_host_allowed(host)
+  local config = require('gh-actions.config')
+
+  for _, allowed_host in ipairs(config.options.allowed_hosts) do
+    if host == allowed_host then
+      return true
+    end
+  end
+
+  return false
+end
+
 --TODO Only periodically fetch all workflows
 --     then fetch runs for a single workflow (tabs/expandable)
 --     Maybe periodically fetch all workflow runs to update
@@ -35,6 +47,10 @@ local function fetch_data()
     state.server = server
   end)
 
+  if not is_host_allowed(server) then
+    return
+  end
+
   gh.get_workflows(server, repo, {
     callback = function(workflows)
       store.update_state(function(state)