set plugin.expose_full_path to false
I know, plugins are disabled anyway. For those, who activate them anyway, I know again, it's not recommend anyway. Some who are behind a transparent proxy or torsocks (or similar) will risk to activate plugins anyway.
Please set plugin.expose_full_path to false.
It doesn't cost you anything, it's easy to add to your already existing changes. It should not effect normal operation of TorButton and it's a little improvement against those shooting their own feet.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information