Fortunately, the source code and test data we're working with are not considered sensitive. As a matter of fact, the separate, less restricted part of the network approach has also been proposed. I don't know what's been holding up that proposal, but assigning responsibility for that separate part of the network can be tricky.

I had always figured DO was the wrong approach because ssh isn't an option, but I suppose if you create a droplet with the VNC over https stuff already set up, then it could just be cloned by everyone else. Thanks for the idea!