Add dashboard-only private incident notes

database/migrations/2026_10_14_000001_add_private_note_to_incidents.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('incidents', function (Blueprint $table) {
+            $table->text('private_note')->nullable()->after('message');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('incidents', function (Blueprint $table) {
+            $table->dropColumn('private_note');
+        });
+    }
+};

resources/lang/en/incident.php

@@ -58,6 +58,8 @@
         'name_label' => 'Name',
         'status_label' => 'Status',
         'message_label' => 'Message',
+        'private_note_label' => 'Private note',
+        'private_note_helper' => 'Only visible in the dashboard. Never shown on the status page or included in API responses, webhooks, or subscriber notifications.',
         'occurred_at_label' => 'Occurred at',
         'occurred_at_helper' => 'The incident\'s created timestamp will be used if left empty.',
         'published_at_label' => 'Published at',

src/Events/Incidents/IncidentCreated.php

@@ -37,7 +37,7 @@ public function broadcastOn(): array
 
     public function getWebhookPayload(): array
     {
-        return $this->incident->toArray();
+        return $this->incident->toWebhookArray();
     }
 
     public function getWebhookEventName(): WebhookEventEnum

src/Events/Incidents/IncidentDeleted.php

@@ -25,7 +25,7 @@ public function __construct(public Incident $incident)
 
     public function getWebhookPayload(): array
     {
-        return $this->incident->toArray();
+        return $this->incident->toWebhookArray();
     }
 
     /**

src/Events/Incidents/IncidentUpdated.php

@@ -34,7 +34,7 @@ public function broadcastOn(): array
 
     public function getWebhookPayload(): array
     {
-        return $this->incident->toArray();
+        return $this->incident->toWebhookArray();
     }
 
     public function getWebhookEventName(): WebhookEventEnum

src/Filament/Resources/Incidents/IncidentResource.php

@@ -27,6 +27,7 @@
 use Filament\Forms\Components\MarkdownEditor;
 use Filament\Forms\Components\Repeater;
 use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Toggle;
 use Filament\Forms\Components\ToggleButtons;
@@ -71,6 +72,11 @@ public static function form(Schema $schema): Schema
                         ->label(__('cachet::incident.form.message_label'))
                         ->required()
                         ->columnSpanFull(),
+                    Textarea::make('private_note')
+                        ->label(__('cachet::incident.form.private_note_label'))
+                        ->helperText(__('cachet::incident.form.private_note_helper'))
+                        ->rows(3)
+                        ->columnSpanFull(),
                     DateTimePicker::make('occurred_at')
                         ->label(__('cachet::incident.form.occurred_at_label'))
                         ->helperText(__('cachet::incident.form.occurred_at_helper')),

src/Models/Incident.php

@@ -39,6 +39,7 @@
  * @property string $name
  * @property ?IncidentStatusEnum $status
  * @property string $message
+ * @property ?string $private_note
  * @property ?Carbon $created_at
  * @property ?Carbon $updated_at
  * @property ?Carbon $deleted_at
@@ -111,6 +112,7 @@ class Incident extends Model implements Metable
         'stickied',
         'notifications',
         'message',
+        'private_note',
         'scheduled_at',
         'occurred_at',
         'published_at',
@@ -292,6 +294,26 @@ public function formattedMessage(): string
         return Cachet::markdown($this->message);
     }
 
+    /**
+     * Exclude private notes, including chaperoned incident copies in loaded relations.
+     */
+    public function toWebhookArray(): array
+    {
+        $redact = function (array $data) use (&$redact): array {
+            unset($data['private_note']);
+
+            foreach ($data as $key => $value) {
+                if (is_array($value)) {
+                    $data[$key] = $redact($value);
+                }
+            }
+
+            return $data;
+        };
+
+        return $redact($this->toArray());
+    }
+
     /**
      * Get the URL to the incident page within the dashboard.
      */

tests/Feature/Filament/Resources/IncidentResourceTest.php

@@ -29,6 +29,40 @@
     actingAs(User::factory()->create(['is_admin' => true]));
 });
 
+it('can create, reload, edit and clear a private note on a public incident', function () {
+    livewire(CreateIncident::class)
+        ->fillForm([
+            'name' => 'Public outage',
+            'status' => IncidentStatusEnum::investigating,
+            'message' => 'We are investigating.',
+            'visible' => ResourceVisibilityEnum::guest,
+            'private_note' => 'Internal ticket SEC-482',
+        ])
+        ->call('create')
+        ->assertHasNoFormErrors();
+
+    $incident = Incident::where('name', 'Public outage')->sole();
+
+    expect($incident->private_note)->toBe('Internal ticket SEC-482')
+        ->and($incident->visible)->toBe(ResourceVisibilityEnum::guest);
+
+    livewire(EditIncident::class, ['record' => $incident->getKey()])
+        ->assertFormSet(['private_note' => 'Internal ticket SEC-482'])
+        ->fillForm(['private_note' => 'Escalated to the security team'])
+        ->call('save')
+        ->assertHasNoFormErrors();
+
+    expect($incident->fresh()->private_note)->toBe('Escalated to the security team');
+
+    livewire(EditIncident::class, ['record' => $incident->getKey()])
+        ->assertFormSet(['private_note' => 'Escalated to the security team'])
+        ->fillForm(['private_note' => null])
+        ->call('save')
+        ->assertHasNoFormErrors();
+
+    expect($incident->fresh()->private_note)->toBeNull();
+});
+
 it('hides the notify subscribers toggle when subscriptions are not allowed', function () {
     $this->get(CreateIncident::getUrl())
         ->assertOk()

tests/Feature/StatusPage/IncidentPageTest.php

@@ -1,8 +1,33 @@
 <?php
 
 use Cachet\Enums\ComponentStatusEnum;
+use Cachet\Enums\ResourceVisibilityEnum;
 use Cachet\Models\Component;
 use Cachet\Models\Incident;
+use Workbench\App\User;
+
+it('never exposes a public incident private note to status page or API viewers', function (bool $authenticated) {
+    if ($authenticated) {
+        $this->actingAs(User::factory()->create(['is_admin' => true]));
+    }
+
+    $incident = Incident::factory()->create([
+        'visible' => ResourceVisibilityEnum::guest,
+        'message' => 'Public incident message',
+        'private_note' => 'Internal ticket SEC-482',
+    ]);
+
+    $this->get(route('cachet.status-page.incident', $incident))
+        ->assertOk()
+        ->assertSee('Public incident message')
+        ->assertDontSee('Internal ticket SEC-482');
+
+    $this->getJson('/status/api/incidents/'.$incident->id)
+        ->assertOk()
+        ->assertJsonPath('data.attributes.message', 'Public incident message')
+        ->assertJsonMissingPath('data.attributes.private_note')
+        ->assertDontSee('Internal ticket SEC-482');
+})->with([false, true]);
 
 it('shows the affected components on the incident page', function () {
     $component = Component::factory()->create(['name' => 'API']);

tests/Unit/Actions/Webhook/DispatchWebhooksTest.php

@@ -3,7 +3,9 @@
 use Cachet\Actions\Webhook\DispatchWebhooks;
 use Cachet\Enums\WebhookEventEnum;
 use Cachet\Events\Components\ComponentCreated;
+use Cachet\Filament\Resources\Incidents\IncidentResource;
 use Cachet\Models\Component;
+use Cachet\Models\Incident;
 use Cachet\Models\WebhookSubscription;
 use Illuminate\Support\Facades\Queue;
 use Spatie\WebhookServer\CallWebhookJob;
@@ -57,3 +59,30 @@
 
     Queue::assertNothingPushed();
 });
+
+it('redacts private notes from queued dashboard incident webhooks', function () {
+    $incident = Incident::factory()->create(['private_note' => 'Internal ticket SEC-482']);
+    $incident->updates()->create(['message' => 'Public update']);
+
+    WebhookSubscription::factory()
+        ->selectedEvents([WebhookEventEnum::incident_updated, WebhookEventEnum::incident_deleted])
+        ->create();
+
+    $record = IncidentResource::getEloquentQuery()->findOrFail($incident->id);
+    $record->update(['name' => 'Updated public name']);
+    $record->delete();
+
+    Queue::assertPushed(CallWebhookJob::class, 2);
+
+    foreach ([WebhookEventEnum::incident_updated, WebhookEventEnum::incident_deleted] as $event) {
+        Queue::assertPushed(CallWebhookJob::class, function (CallWebhookJob $job) use ($event): bool {
+            return $job->payload['event'] === $event->value
+                && $job->payload['body']['name'] === 'Updated public name'
+                && $job->payload['body']['updates'][0]['message'] === 'Public update'
+                && ! str_contains(json_encode($job->payload), 'private_note')
+                && ! str_contains(json_encode($job->payload), 'Internal ticket SEC-482');
+        });
+    }
+
+    expect($record->private_note)->toBe('Internal ticket SEC-482');
+});

tests/Unit/Models/IncidentTest.php

@@ -3,10 +3,35 @@
 use Cachet\Actions\Incident\SyncIncidentStatus;
 use Cachet\Enums\ComponentStatusEnum;
 use Cachet\Enums\IncidentStatusEnum;
+use Cachet\Events\Incidents\IncidentCreated;
+use Cachet\Events\Incidents\IncidentDeleted;
+use Cachet\Events\Incidents\IncidentUpdated;
 use Cachet\Models\Component;
 use Cachet\Models\Incident;
 use Cachet\Models\Update;
 
+it('keeps private notes out of incident webhooks', function () {
+    $incident = Incident::factory()->create(['private_note' => 'Internal ticket SEC-482']);
+    $incident->updates()->create(['message' => 'Public update']);
+    $incident->load('updates');
+
+    expect($incident->fresh()->private_note)->toBe('Internal ticket SEC-482');
+
+    foreach ([IncidentCreated::class, IncidentUpdated::class, IncidentDeleted::class] as $event) {
+        $payload = (new $event($incident))->getWebhookPayload();
+
+        expect($payload)
+            ->toHaveKey('message', $incident->message)
+            ->not->toHaveKey('private_note')
+            ->and($payload['updates'][0]['message'])->toBe('Public update')
+            ->and($payload['updates'][0]['updateable']['message'])->toBe($incident->message)
+            ->and(json_encode($payload))->not->toContain('private_note', 'Internal ticket SEC-482');
+    }
+
+    expect($incident->private_note)->toBe('Internal ticket SEC-482')
+        ->and($incident->updates->first()->updateable->private_note)->toBe('Internal ticket SEC-482');
+});
+
 it('can have multiple components', function () {
     $incident = Incident::factory()->create();