image in a tab field

I think Components Anywhere is a security risk I was able to pull up admins profile in the delimiter
can I send you a private message so you can have a look please?

We're not the developer of Components Anywhere. It simply displays a component view as I understand it. So if you're displaying a users profile and viewing user would normally have access to it then it'll probably display it fine. If it shouldn't then you'll need to take that up with Components Anywhere. It should not be ran on any user input content, which Custom HTML fields are not user input so it's fine.

Where do I put this code you suggested?
( SELECT COUNT( * ) FROM `#__comprofiler_members` AS m WHERE m.`referenceid` = 554 AND m.`memberid` = u.`id` AND m.`accepted` = 1 ) > 0

I put it in delimiter field Im a bit lost
It looks like a database query I want a users connections list in a delimiter field
Do I use a sql action?
Thanks

That SQL is for an Advanced filter on a userlist. Create or edit an existing userlist in CB > List Management then under Filters toggle it to Advanced then add that SQL.