I’m not sure if this belongs in bug reports or not, but it seems that you can generate a URL preview in an encrypted note, and save that note successfully.
Closing + reopening the app, and unlocking the note shows the pics load instantly, so they’re not obviously loaded on the fly. Can you confirm if this is a case of:
A) All URL previews are stored in some other database, and therefore the previews exposes some contents of locked notes?
B) Some pictures can be stored inside encrypted notes, even if only through URL preview mechanism?
EDIT On further examination it appears possibly these are stored in some sort of local cache? I synced the note to my iPhone and it loaded the previews fresh here. In my mind, this does expose some level of potential risk if these expose URL’s stored in locked notes. If these are cached outside of locked notes, perhaps this feature should be unavailable to locked notes until attachments can be stored inside them?