Can end users see attachment not sent to them within a response? 

Environment:

Incident File Attachments

B2C Service

Resolution:

Even when attachments are not sent to customers within a response, the customer can see public attachments when logged into the customer portal and viewing their service requests. In order to prevent end users from seeing attachments on incidents, set the attachment to Private. This is an option under the attachment properties. When the agent adds an attachment to an incident, click the Properties option and then select Private to prevent end users from seeing the attachments. 

If the agent then wants to send a private attachment to the customer, first unselect the "private" option so that the attachment will be viewable when including it in a response. 

By default, the attachments are public so that end users can see them when included in a response, or when viewing their service request in the customer portal.