Ask HN: What are you using to run dev environments safely on macOS these days?

Given today's LiteLLM supply chain attack, where running "pip install litellm" (or "pip install dspy" or any other package that had LiteLLM as an unpinned dependency), I'm feeling motivated to figure out a good pattern for running a development environment on my Mac where rogue code can't steal all of my ~/.file credentials!

What do people use and like for that these days?