Disable MOZ_DISABLE_CONTENT_SANDBOX
MOZ_DISABLE_CONTENT_SANDBOX can be used at runtime to disable the content sandbox. If an attacker can influence this, we're probably already sunk, but just like we disable the "Dump all your TLS Session Keys here please" environment variable, we should disable this one too.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information