# X_EXERCISE_SETUP_UNSEALED

## Means

an exercise setup let a host through the seal

## Typical cause

defineExercise(…, { setup }) called allowHost(): the pass would send a primitive's call out for real, where every vendor is answered by mockFetch or cassette()

## Fix

`mockFetch('https://<host>/*', handler)` — or cassette(import.meta.dir, '<name>') — in apps/web/exercise.ts's setup, in place of allowHost('<host>')

[Testing](/error-codes#testing)