Related to issue 0009321. Maybe if a user doesn't have access to a certain note, he shouldn't see a link to it, with all its associated details.

In my system, I'm trying to limit each user's view to only his assigned project(s) (all projects are private, all users are globally Viewers). By inserting random issue notes, other user names become visible that otherwise are inaccessible. I use First_Last as username for some of my users, and since sometimes links get inserted inadvertently, the result is that random other users sometimes get exposed.

Also, by linking to a private note it's possible to discover its author.