THE GITHTML FIELD GUIDE
Diagnose missing images from a private repository
Verify the asset path and the authorization context separately. A private image that opens in your signed-in browser may not be available to the HTML renderer through the same URL. Do not insert tokens or signed credentials into the document. Use an approved portable export or a supported authorized access path instead.
Distinguish access from location
A missing private asset does not necessarily mean the path is misspelled. The request may reach the correct location but lack authorization, or it may receive an HTML login page rather than image data. Check the response through an appropriate authorized tool without exposing credentials in screenshots, logs, or shared notes.
Compare the audience of the HTML document with the audience of its assets. If the report is public but the picture is private, there is a genuine sharing mismatch to resolve. Making the URL easier to fetch is not the same as obtaining permission to publish the image. Ask the owner which material may be included before changing its packaging or visibility.
Avoid credential-based shortcuts
Embedding a personal token into an image URL is unsafe and fragile. The token may be committed, copied, logged, or shared with everyone who receives the HTML. Temporary signed URLs also expire and can encode access that should not be distributed casually. Neither is a good foundation for a durable reading artifact.
A better authoring workflow uses authorized access locally to prepare an approved static export, then includes only material intended for the document's readers. Keep secrets out of the output. If a visual cannot be shared, replace it with a non-sensitive explanation or clearly state that the evidence is available only through the authorized source.
State the dependency honestly
If remote private assets remain part of the design, explain that access depends on the reader's authorization and settings. gitHtml does not promise that every repository asset is mirrored automatically, and remote resources are off by default. Do not describe the HTML as self-contained when critical images still require a separate authenticated request.
- Confirm the exact committed path and filename case.
- Check whether the response is image data, an error, or a login page.
- Identify who is authorized to see the asset.
- Remove credentials from any proposed HTML or example URLs.
- Choose an approved embedded copy, a non-sensitive replacement, or a documented restricted dependency.
- Verify that the report's conclusion remains understandable if the image cannot be fetched.
Sources and further reading
AI-assisted writing with source-linked guidance and illustrative examples. Read our editorial approach or report a correction.