$filablle is used for input filter but not $guarded for Models

[Jacq]

I had some problems when saving a resource where messages like this appear in the log:

Column not found: 1054 Unknown column 'slug' in 'field list' (SQL: update `actividades` set `published` = 1, `public` = 0, `publish_start_date` = 2020-07-24 08:38:30, `slug` = ?, `cmsSaveType` = update, `languages` = [{"shortlabel":"ES","label":["Spanish","Espa\u00f1ol"],"value":"es","disabled":false,"published":true}], `parent_id` = 0, `actividades`.`updated_at` = 2020-07-24 08:38:30 where `id` = 1)"

Debugging the request I notice these fields 'slug', 'cmsSaveType', 'languages', 'parent_id'... values that indeed are not in my database but reach the final DB update. I think the problem is with the check of $fillable/$guarded. In my case I used $guarded=only with ['id'] instead of $fillable with all the fields.
Doing this causes the input received from the form not to be filtered properly and these 'cmsSaveType', 'slug'... fields that are related to Twill form internals and other relations, reach the update of the DB.
I don't know if this should be marked as a bug, clarify in the documentation the use of $guarded/$fillable or other action should be taken, so I just report it here for anyone experiencing the same error messages.
Cheers,
Jacq

[Jacq]

This is indeed commented in the docs: https://twill.io/docs/#models
Set your fillables to prevent mass-assignement. This is very important, as we use request()->all() in the module controller.
But may be the reference to $guarded use (or avoid used) should be metion as is a standard alternative to $fillable.
Also the other implications that might not be clear of not including some fields, for example not including 'publish_start_date','publish_end_date' in the $fillable prop causes not to show them in the form.