I have a related question on how developers should sandbox their dev work from other uses of their computer (banking, email etc). Even though one might vet/vend

I have a related question on how developers should sandbox their dev work from other uses of their computer (banking, email etc). Even though one might vet/vendor dependencies, these (say pining a version) are done closer to production/testing. Developers might be more relaxed updating to newer version for the purpose of vetting them. I am glad VsCode pops up a warning on all new repos - but that kind of warning will often end up getting dismissed because it occurs all too often. Should all dev work happen in VMs? Docker? Where is the web-of-trust solution for dependencies? Where is the notary service for dependencies? This all feels like a ticking bomb to me.