Remote reference
The URL is visible and editable, but MD Studio does not request it for preview.
Markdown image security guide
Keep the image reference without silently loading the remote image
MD Studio can preserve a remote image URL in Markdown while refusing to fetch it automatically in the preview or rendered-HTML output. That separates source conversion from third-party network activity.
A URL in Markdown is not the same as a trusted asset
An image reference can reveal a visitor's network address and request metadata to the remote host, fail after publication, change without notice, or require authentication. MD Studio keeps the author-visible reference but leaves the fetch decision to the final publishing environment.
What MD Studio does
| Reference | Source behavior | Preview/output behavior |
|---|---|---|
Remote https:// image | URL remains in Markdown | Not loaded automatically |
| Relative same-origin image | Relative reference remains | May render when it resolves safely on the MD Studio origin |
| Unsafe or unsupported URL | Treated as untrusted input | Sanitization and output policy prevent active loading |
| Image binary from a document | MD Studio is not an image-hosting service | No upload or automatic hosted replacement is created |
Markdown image syntax itself is part of the CommonMark image specification. Whether a renderer fetches a URL is a separate product and security decision.
The source remains explicit
Relative project reference
The project that publishes the Markdown must contain the file at the expected relative path.
Review every image reference before publishing
- Meaningful alt text: describe the information or purpose, not merely “image.”
- Ownership and permission: confirm you may republish the image.
- Stable location: avoid temporary, signed, session-bound, or private URLs.
- Audience access: ensure readers can reach the asset without your account or cookies.
- Privacy: understand what the destination sends to the image host.
- Integrity: consider copying important assets into the controlled publishing repository.
- Final renderer: test the published output; MD Studio intentionally does not prove remote availability.
Choose an asset strategy deliberately
Keep the remote URL
Appropriate when the source is trusted, stable, public, permitted, and expected to remain available.
Store the asset with the project
Often better for documentation repositories where versioning, review, and predictable availability matter.
Remove or replace it
Use this when the image is decorative, inaccessible, private, unstable, or unnecessary to understand the document.
Remote-image FAQ
Why does my image syntax remain but the preview shows no image?
That is intentional for remote URLs. MD Studio preserves the author-visible reference while preventing an automatic third-party request.
Can MD Studio download and rehost the image?
No. URL import, image proxying, cloud storage, and image hosting are outside the product scope.
Does blocking the preview guarantee the final site will not fetch it?
No. The final renderer controls its own network behavior. Review the destination's content security, privacy, and asset policies.
What happens when I download rendered HTML?
MD Studio sanitizes output again and does not automatically enable remote images. The downloaded document also includes a restrictive content security policy.
Keep conversion and network trust as separate decisions
Preserve the reference, inspect it, then decide where the final asset should live.
Open MD Studio