Sandboxing the IDE and backend for protection against recruiting scams, supply chain compromise, and confused AI agents
I'm working on a more secure development workflow.
We developers face growing threats from our software supply chain, confused AI agents, and recruiting scams. It's a matter of time before more & more devs have their laptop and the credentials on them compromised. Worm-able compromise using your creds is coming, and is arguably already here.
Isolating your development environment, including the toolchain, repos, AI harness, and IDE, is where we should all be heading.
Surprisingly this is not the case yet. JetBrains remote dev has the right pieces for it. This screenshot is something I worked on yesterday & today to sandbox my JetBrains IDE and have the IDE connect to a second VM where the project / repos / AI harness / etc. actually live. This is a defense-in-depth approach that I think we should all be considering.
This runs on my MacBook Air (2025) 13 M4 32GB. I'm still cleaning it up a bit, but it looks like a viable approach.
I'm going to investigate some other options for the IDE client and might switch to a Framework 13 Pro w/ Linux, or may continue using MacOS as my daily driver if sandboxing the IDE client doesn't end up being too costly.
Please share your thoughts! How are you keeping your workstation safe from compromised repos, poisoned dependencies, or confused AI agents? How do you want to? What is your workplace doing to solve for this?