FiL_Design_ImageMind 1.1.0 and 1.1.1 flagged by the Registry security scan

Manual review request: FiL_Design_ImageMind 1.1.0 and 1.1.1 flagged by the Registry security scan

---

**Node:** `FiL_Design_ImageMind`
**Publisher:** `fil-design-ai`
**Registry:** https://registry.comfy.org/nodes/FiL_Design_ImageMind
**Repository:** https://github.com/FiL-Design-Ai/FiL_Design_ImageMind

### The problem

Versions 1.1.0 and 1.1.1 are both `NodeVersionStatusFlagged`. 1.0.0 is still `NodeVersionStatusActive`, so the registry keeps serving 1.0.0 and no user can receive an update:

```
1.1.1 NodeVersionStatusFlagged
1.1.0 NodeVersionStatusFlagged
1.0.0 NodeVersionStatusActive
```

No reason is shown in the publisher dashboard, and `GET /nodes/FiL_Design_ImageMind/versions` carries no `status_detail`. Could you share the specific scan findings for these two versions? Without them we are guessing at what to change.

### What the pack does

Image-understanding and prompt-generation nodes: they send an image to a vision LLM and return a generated prompt. Outbound HTTPS to model providers (Google, Groq, OpenRouter, Cloudflare, Ollama, LM Studio, OpenAI) is the pack's core function, not incidental behaviour. The HTTP layer lives in `common/network.py`, `common/provider_runtime.py`, `common/provider_resilience.py` and `server_routes.py`.

If the finding is `python_network_operations` — as in #3111 — that is precisely what the pack exists to do. API keys are supplied by the user and stored locally; nothing is sent anywhere except to the provider the user selected.

### What the published archive does not contain

Checked over the actual published file set (`.comfyignore` excludes `tests/`, `tools/`, `scripts/`, `.github/`):

- no `eval` / `exec`
- no `subprocess` / `os.system`, and no runtime package installation
- no `pickle.load` / `marshal.load`
- no custom pip wheels

### One concrete difference between 1.0.0 (Active) and 1.1.0 (Flagged)

1.1.0 was the first release to exclude the frontend sourcemap from the published archive, which left a 619 KB minified bundle with `frontend/src/` also excluded. If the scan reads that as obfuscated code, it would explain why the status changed exactly at that release. The sourcemap has been restored on `main`, so future releases ship readable source alongside the bundle.

We are not claiming this is the cause — we cannot see the findings. It is simply the only difference we could identify between the version that passed and the ones that did not.

### Ask

Please review 1.1.1 and unflag it if the findings are false positives, or tell us which pattern to change and we will change it.

Start by reviewing the published version statuses and GET /nodes/FiL_Design_ImageMind/versions, then compare the 1.0.0, 1.1.0, and 1.1.1 archives, including the files named in the issue. Done means the specific scan findings are identified and the publisher receives either unflagging or actionable guidance.

Written by the indexing model from the issue text.