Put it in a sandboxed iframe, serve it from a separate domain, and use a very restrictive CSP?