Attaching a photo or file, and who sees it

Staff can attach files to a ticket from a phone, including straight from the camera, and choose whether the client sees them. It defaults to staff only, and that default is the point: the mistake worth designing against is a screenshot of a server console, or another customer's data, reaching a client because a toggle happened to be on. Getting that wrong the safe way costs one tap to fix; getting it wrong the other way cannot be taken back. Staff only is stored as a WHMCS ticket note rather than a flag this app invents, so the WHMCS admin area treats it as private too, and a client-visible file is an ordinary reply. Clients uploading to their own ticket always post a reply, since they have no notes to write in. Files must be under 12MB, and anything a web server might try to execute is refused whatever it is named.