A few things that I've been carefully about:
- Separate dev machine. This has agentic infrastructure. Should soon be replaced by dev boxes
- Dev machine has no passwords, gpg keys, ssh keys.
- all cli tools are scope with PAT with RO permissions.
- github/bitbucket/gitlab use scoped PATs
- use yarn v4 or uv which allows you to exclude *new packages*
- If you *really* need passwords, then store it in apple keychain. But I would recommend avoiding it.
- Separate browsing machine where you don't install random binaries, this can have passwords.
Yes, this is draconian but this is the only way to stay safe.