Keep selected Drupal modules out of PROD automatically with Drush.

.gitignore

# Create a safe space for dangerous modules.
/sites/*/modules/ignored/
/docroot/sites/*/modules/ignored/

quarantine.drush.inc

/**
 * Store dangerous contrib modules in an 'ignored' directory.
 *
 * See @pm_drush_pm_download_destination_alter().
 *
 * @param array $project
 *   Information about the project.
 * @param array $release
 *   Information about the particular release version being downloaded.
 */
function quarantine_drush_pm_download_destination_alter(&$project, $release) {
  $safe_place = DRUPAL_ROOT . '/sites/all/modules/ignored';
  $quarantine = array(
    'coder',
    'coffee',
    'devel',
    'devel_themer',
    'masquerade',
    'module_filter',
  );

  // Alter the destination of quarantined modules.
  if (in_array($project['name'], $quarantine)) {
    $project['project_install_location'] = $safe_place;
  }
}

Know how this would work for D8 or using composer? Fork this and post the link here or post your additions in the comments and I'll update.