The naive scenario is to fire up those VMs in a network completely contained within your development system and test locally. This makes the VMs safe.

However this seldom works because web sites, even the ones running on localhost, have all sort of external dependencies, from webfonts to third part assets stored on CDNs. So VMs need an access to the Internet and that access could compromise them.

Probably restoring them from the original image after each shutdown is the best way to fix this issue.