[jhancock]

containerize all the things...Nix, Podman, Docker. It's not a big hassle once you get through the initial steps.

Would be good to see projects (like those recently effected) nudging devs to do this via install instructions.

[christophilus]

Yep. This is what I do. I edit and run my code in a container. That container cannot access my ssh keys or publish to GitHub. I review all changes, and manually commit / publish on my host. It’s not perfect, but that plus vendoring my dependencies goes a long way towards mitigating these kinds of things.