Re: Least worst option
Its really not hard. If you really want to abdicate your responsibilities for managing the code you download to people's browsers to third parties there are many ways to make the code available without allowing the third party to see the user's own IP address.
Two immediately obvious, old-skool approaches are (i) to host the code yourself and have a regular, or even (if you insist) automated update process to fetch new code, (ii) just reverse-proxy the download from your web server so the 3rd party sees only your IP address. These can be trivially enhanced with a caching web server, or can be out-sourced to a third party (such as a CDN) as long as you have appropriate commercial agreements in place to mean you are the data processor and they cannot make their own use of the data they get.
Better still, keep the code simple and employ appropriate programmers (such as through a 3rd party website creation company) to make sure it is professionally maintained. Treat it exactly as you treat your ERP system and your outsourced HR.
Biting the hand that feeds IT
