Comment by elric

I run Obsidian with restricted capabilities: no network access, and no filesystem access outside its own directory. I only enable network access when updating plugins/themes.

Same way I run any other application that could potentially execute untrusted code.