data/reusables/enterprise_installation/image-urls-viewable-warning.md

If you add an image attachment to a pull request or issue comment, anyone can view the anonymized image URL without authentication{% ifversion ghes %}, even if the pull request is in a private repository, or if private mode is enabled. To prevent unauthorized access to the images, ensure that you restrict network access to the systems that serve the images, including {% data variables.location.product_location %}{% endif %}.