There are ways to limit the blast radius, like running them in ephemeral rootless containers with only the project files mounted.