diff --git a/backend/api/index.php b/backend/api/index.php
index 38c46dd..f7037e1 100644
--- a/backend/api/index.php
+++ b/backend/api/index.php
@@ -368,8 +368,8 @@ function handleNodes($method, $id, $db) {
         case 'POST':
             $data = json_decode(file_get_contents('php://input'), true);
             $stmt = $db->prepare("
-                INSERT INTO network_nodes (label, ip_address, node_type, status, group_name, pos_x, pos_y)
-                VALUES (?, ?, ?, ?, ?, ?, ?)
+                INSERT INTO network_nodes (label, ip_address, node_type, status, group_name, pos_x, pos_y, notes)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
             ");
             $stmt->execute([
                 $data['label'],
@@ -378,7 +378,8 @@ function handleNodes($method, $id, $db) {
                 $data['status'] ?? 'unknown',
                 $data['group_name'] ?? 'default',
                 $data['pos_x'] ?? 0,
-                $data['pos_y'] ?? 0
+                $data['pos_y'] ?? 0,
+                $data['notes'] ?? ''
             ]);
             echo json_encode(['id' => $db->lastInsertId()]);
             break;
@@ -387,7 +388,7 @@ function handleNodes($method, $id, $db) {
                 $data = json_decode(file_get_contents('php://input'), true);
                 $fields = [];
                 $params = [];
-                foreach (['label','ip_address','node_type','status','group_name','pos_x','pos_y'] as $f) {
+                foreach (['label','ip_address','node_type','status','group_name','pos_x','pos_y','notes'] as $f) {
                     if (isset($data[$f])) {
                         $fields[] = "$f = ?";
                         $params[] = $data[$f];
diff --git a/backend/config/database.php b/backend/config/database.php
index 2dd82ed..3df077c 100644
--- a/backend/config/database.php
+++ b/backend/config/database.php
@@ -38,4 +38,6 @@ function migrate($db) {
         role ENUM('admin','user') DEFAULT 'user',
         created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
     )");
+    // Add notes column if missing
+    try { $db->exec("ALTER TABLE network_nodes ADD COLUMN notes TEXT DEFAULT ''"); } catch (Exception $e) {}
 }
\ No newline at end of file
diff --git a/frontend/assets/js/app.js b/frontend/assets/js/app.js
index 876be26..8e6b165 100644
--- a/frontend/assets/js/app.js
+++ b/frontend/assets/js/app.js
@@ -393,6 +393,7 @@ function selectNode(id, add) {
                 '<div><span class="text-secondary">Type:</span> ' + n.node_type + '</div>' +
                 '<div><span class="text-secondary">Status:</span> ' + n.status + '</div>' +
                 '<div><span class="text-secondary">Group:</span> ' + n.group_name + '</div>' +
+                (n.notes ? '<div class="mt-1 p-1 rounded" style="background:#0d1117;font-size:.75rem;color:#94a3b8;"><i class="fas fa-sticky-note me-1"></i>' + esc(n.notes) + '</div>' : '') +
                 (selectedNodeIds.length > 1 ? '<small class="text-secondary">+' + (selectedNodeIds.length - 1) + ' more selected</small>' : '') +
                 '<div class="mt-2 d-flex gap-1">' +
                     '<button class="btn btn-outline-primary btn-sm" onclick="editSelectedNode(' + n.id + ')"><i class="fas fa-pen me-1"></i>Edit</button>' +
@@ -495,6 +496,7 @@ async function saveNode() {
         node_type: document.getElementById('nodeType').value,
         status: document.getElementById('nodeStatus').value,
         group_name: document.getElementById('nodeGroup').value || 'default',
+        notes: document.getElementById('nodeNotes').value,
         pos_x: Math.random() * canvas.width * 0.6 + canvas.width * 0.2 - panX,
         pos_y: Math.random() * canvas.height * 0.6 + canvas.height * 0.2 - panY
     };
@@ -502,7 +504,8 @@ async function saveNode() {
     if (editingNodeId) {
         await apiFetch('nodes/' + editingNodeId, { method: 'PUT', body: JSON.stringify({
             label: data.label, ip_address: data.ip_address,
-            node_type: data.node_type, status: data.status, group_name: data.group_name
+            node_type: data.node_type, status: data.status,
+            group_name: data.group_name, notes: data.notes
         })});
         editingNodeId = null;
     } else {
@@ -524,6 +527,7 @@ function editSelectedNode(id) {
     document.getElementById('nodeType').value = n.node_type;
     document.getElementById('nodeStatus').value = n.status;
     document.getElementById('nodeGroup').value = n.group_name;
+    document.getElementById('nodeNotes').value = n.notes || '';
     document.getElementById('nodeModalLabel').textContent = 'Edit Network Node';
     document.getElementById('saveNode').innerHTML = '<i class="fas fa-save me-1"></i> Update Node';
     new bootstrap.Modal(document.getElementById('nodeModal')).show();
diff --git a/frontend/index.html b/frontend/index.html
index 2dd365d..961d3e1 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -240,6 +240,10 @@
                         <label class="form-label small">Group</label>
                         <input type="text" class="form-control form-control-sm" id="nodeGroup" placeholder="e.g. DMZ, Internal, Cloud">
                     </div>
+                    <div class="mb-2">
+                        <label class="form-label small">Notes</label>
+                        <textarea class="form-control form-control-sm" id="nodeNotes" rows="2" placeholder="Tags, descriptions, vulnerabilities..."></textarea>
+                    </div>
                 </form>
             </div>
             <div class="modal-footer border-secondary">