I have a concern I would like the input of the software developer community, but can't decide where to post it.
Basically, I'm wondering how to handle developing software when data security of the clients I work for is a serious concern.
Here's a draft of the question:
Nowadays, developing software involves downloading un-vetted, open-source libraries (npm, nuget, jars in general) that could do... well, anything when on your system and executed in your project/IDE.
So when I have sensitive data on the same machine it is potentially endangered. Hence the problem of how to handle this generally when developing modern software while having potentially data on your machine that needs to be secured from leaking.
I can imagine that you'd have one developing machine and one data machine on separate networks, and the developer needs to switch between them depending on what they need to do. But this will immedately fail if you need test data while developing. Because moving that to the "unsecure" machine will also make the data unsecure.
Another idea would be to completely lock down "pushing" from the developer machine, so it can only download from the internet but never push (or only on very specific ports to very specific IPs. But I can see this approach to become a management nightmare.
So, I'm looking for any well-known approaches to developing software using external, inherently unsecure, resources (like npm libs or unvetted IDEs, plugins, etc.) in regards to sensitive data that must not be leaked to nefarious sources?
I feel this should be a good question for SE.SE but it could also "bleed" to security.SE or even law.SE...
What do you think? Where sould I post this?