Disable the Gamepad API
The GamePad API allows JS to silently query all attached videogame controlers and extract their USB device IDs and other vendor info strings, without user interaction: https://developer.mozilla.org/en-US/docs/Web/Guide/API/Gamepad
We should just disable this API via its pref for now.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information