I know where you are coming from and I considered this myself again and again. For me and for now it is not something I want to do and not primarily because of

I know where you are coming from and I considered this myself again and again. For me and for now it is not something I want to do and not primarily because of the effort. The VM might protect me, but it will not protect the users of the software I am producing. How can I ship a product to the customer and expect them to safely use it without protection when I myself only touch it when in a hazmat suit? No, that is not the environment I want. My current solution is to be super picky with my dependencies. More specifically I hold the opinion that we should neither trust projects nor companies but only people. This is not easy to do, but I do not see a better alternative as for now.