twilio-security-hardening

Validate Twilio webhooks using the SDK's validateRequest function with your auth token, the X-Twilio-Signature header, the exact request URL, and request body. The URL must match exactly, including HTTPS scheme and query string parameters.

Use API keys in production because they are scoped and individually revocable. Rotating the auth token invalidates all existing API keys simultaneously, which can break every integration at once.

Prevent SMS pumping with layered defenses: enable Verify Fraud Guard, run Lookup line-type and risk-score checks before sending, restrict geo-permissions to countries you serve, and rate-limit verification attempts per IP and phone number.

No, PCI Mode is irreversible and account-wide once enabled. The recommended approach is creating a separate sub-account dedicated to payment-related calls so the main account remains unaffected.

HIPAA compliance requires executing a Business Associate Agreement with Twilio, encrypting all recordings containing PHI, minimizing PHI in text-to-speech, rotating API keys regularly, and restricting access to recordings and transcripts.