1674942 - Ok, so we need to add controlling the pdfjs.enableScripting pref to our Security Level logic. See this thread with response from Giorgio (the No-Script guy)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information