This is what I do for a "learn to code" game I'm building. The sandboxed Web worker is served with CSP headers and only interacts with the main part of the page through worker messages.