{"id":114,"date":"2026-10-17T14:15:44","date_gmt":"2026-10-17T14:15:44","guid":{"rendered":"http:\/\/plugin-docs.com\/?post_type=doc&#038;p=114"},"modified":"2026-10-17T18:08:40","modified_gmt":"2026-10-17T18:08:40","slug":"why-can-a-customer-see-a-private-staff-note","status":"publish","type":"doc","link":"https:\/\/dragwyb.com\/docs\/why-can-a-customer-see-a-private-staff-note\/","title":{"rendered":"Why can a customer see a private staff note?"},"content":{"rendered":"<p>Dragwyb Click to Chat stores private staff notes separately from customer-facing ticket messages. In the inspected plugin version, internal notes are managed through staff-only support endpoints, and the customer portal response filters internal notes and staff-only metadata before returning a ticket. If a customer appears to see a private staff note, treat it as a potential privacy issue and verify the actual response and user permissions before continuing normal support work.<\/p>\n\n<h2>1. Stop and verify the affected ticket<\/h2>\n<ol>\n<li>Do not add further sensitive information to the affected ticket until you understand what the customer can see.<\/li>\n<li>Record the ticket ID and the exact note\/message that appears to be exposed. Avoid copying private customer information into public reports or screenshots.<\/li>\n<li>Open the ticket as an authorized staff member and confirm the item was created using the internal-note control, not the customer reply composer.<\/li>\n<li>Sign in with a separate test customer account and open only a ticket that account is authorized to access.<\/li>\n<\/ol>\n<h2>2. Confirm how the note was created<\/h2>\n<p>The support-note service stores internal notes under a dedicated metadata key and checks the staff member&#8217;s internal-note permission and access to the ticket. The staff-note endpoints also check ticket access. If the content was added through a normal reply instead of the internal-note control, it may be a customer-visible message rather than a private note.<\/p>\n<h2>3. Check the customer-facing portal response<\/h2>\n<p>The customer portal ticket-detail endpoint authorizes the visitor for the requested ticket and passes the record through a filter that removes internal notes, tokens, and staff-only metadata. Test the affected flow using the public portal and the same type of customer session that reported the issue.<\/p>\n<ul>\n<li>Verify that a private note does not appear in the customer-facing conversation timeline.<\/li>\n<li>Check whether the issue occurs only in one page builder template, cached page, or custom theme integration.<\/li>\n<li>Compare the result in a private browser session after clearing the page cache, without reusing an agent session.<\/li>\n<li>Do not use an administrator&#8217;s logged-in browser as proof of what a customer sees.<\/li>\n<\/ul>\n<h2>4. Review staff permissions and customizations<\/h2>\n<p>Review the Support Center role-permission configuration, especially the internal-note capability and which staff roles can access the ticket. If the site has custom code, a child-theme override, a modified portal template, or an integration that returns ticket data directly, verify that it does not bypass the plugin&#8217;s customer-facing filter.<\/p>\n<h2>5. If the note is still visible<\/h2>\n<ol>\n<li>Temporarily disable the affected custom integration or portal customization on staging, if one is involved.<\/li>\n<li>Reproduce the issue with a test ticket and a customer account that does not have staff permissions.<\/li>\n<li>Capture only redacted evidence and review the response returned by the customer portal endpoint.<\/li>\n<li>Update the plugin to the intended current release if the installed files differ from the inspected source, then retest.<\/li>\n<li>Do not resume storing sensitive internal information in notes until the exposure has been understood and resolved.<\/li>\n<\/ol>\n<h2>Related guides<\/h2>\n<ul>\n<li><a href=\"https:\/\/dragwyb.com\/docs\/docs\/dragwyb-click-to-chat\/faq\/\">Frequently Asked Questions<\/a><\/li>\n<li><a href=\"https:\/\/dragwyb.com\/docs\/docs\/dragwyb-click-to-chat\/why-can-a-guest-not-access-a-support-ticket\/\">Why can a guest not access a support ticket?<\/a><\/li>\n<li><a href=\"https:\/\/dragwyb.com\/docs\/docs\/dragwyb-click-to-chat\/faq-add-user-ticket-list\/\">How do I add a user ticket list?<\/a><\/li>\n<\/ul>\n<p><strong>Security note:<\/strong> The source includes filtering and permission checks, but this documentation update does not prove that your live site is secure. Test with a separate customer account and investigate any reproducible exposure before production use.<\/p>","protected":false},"excerpt":{"rendered":"<p>Troubleshoot private staff notes that appear in customer tickets by checking note type, portal filtering, permissions, and customizations.<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":107,"menu_order":0,"template":"","class_list":["post-114","doc","type-doc","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc"}],"about":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/types\/doc"}],"version-history":[{"count":1,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/114\/revisions"}],"predecessor-version":[{"id":380,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/114\/revisions\/380"}],"up":[{"embeddable":true,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/107"}],"wp:attachment":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/media?parent=114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}