- services.AddSingleton<IMemoryDraftStore, MemoryDraftStore>();

-            IocManager.IocContainer.Register(
-                Castle.MicroKernel.Registration.Component
-                .For<IChatAppService>()
-                .ImplementedBy<ChatAppService>()
-                .LifestyleSingleton()
-            );

-            IocManager.IocContainer.Register(
-                Castle.MicroKernel.Registration.Component
-                .For<HttpClient>()
-                .LifestyleSingleton()
-            );

-    private string ExtractJson(string aiReply)
-    {
-        var jsonMatch = Regex.Match(aiReply, @"```json\s*(\{.*?\})\s*```", RegexOptions.Singleline);
-        if (jsonMatch.Success)
-            return jsonMatch.Groups[1].Value;
-
-        var braceMatch = Regex.Match(aiReply, @"\{.*\}", RegexOptions.Singleline);
-        if (braceMatch.Success)
-            return braceMatch.Value;
-
-        return null;
-    }
+    private string ExtractJson(string aiReply)
+    {
+        if (string.IsNullOrWhiteSpace(aiReply)) return null;
+
+        var jsonBlock = Regex.Match(aiReply, @"```json\s*(\{[\s\S]*?\})\s*```", RegexOptions.Singleline);
+        if (jsonBlock.Success) return jsonBlock.Groups[1].Value;
+
+        // Fallback: scan for first balanced JSON object
+        int depth = 0, start = -1;
+        for (int i = 0; i < aiReply.Length; i++)
+        {
+            var c = aiReply[i];
+            if (c == '{')
+            {
+                if (depth == 0) start = i;
+                depth++;
+            }
+            else if (c == '}')
+            {
+                depth--;
+                if (depth == 0 && start >= 0)
+                {
+                    return aiReply.Substring(start, i - start + 1);
+                }
+            }
+        }
+        return null;
+    }

 public bool IsReadyForSubmission =>
-    !string.IsNullOrWhiteSpace(ReferenceNumber) &&
-    PriorityLevel.HasValue &&
+    PriorityLevel.HasValue &&
     !string.IsNullOrWhiteSpace(Location) &&
     !string.IsNullOrWhiteSpace(Category) &&
     !string.IsNullOrWhiteSpace(Description) &&
     SendUpdates.HasValue &&
     !string.IsNullOrWhiteSpace(CustomerNumber);

@@ -42,7 +42,7
-    "AccountSid": "${TWILIO_ACCOUNTSID}",
-    "AuthToken": "${TWILIO_AUTHTOKEN}",
-    "WhatsAppNumber": "whatsapp:+14155238886"
+    "AccountSid": "",
+    "AuthToken": "",
+    "WhatsAppNumber": "whatsapp:+14155238886"

 using GlassTickets.Services.Whatsapp;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Configuration;
+using Twilio.Security;
@@
     public class TwilioWebhookController : ControllerBase
     {
         private readonly IWhatsAppChatAppService _whatsAppChatService;
         private readonly ITwilioService _twilioService;
+        private readonly IConfiguration _config;
@@
-        public TwilioWebhookController(
-            IWhatsAppChatAppService whatsAppChatService,
-            ITwilioService twilioService)
+        public TwilioWebhookController(
+            IWhatsAppChatAppService whatsAppChatService,
+            ITwilioService twilioService,
+            IConfiguration config)
         {
             _whatsAppChatService = whatsAppChatService;
             _twilioService = twilioService;
+            _config = config;
         }
@@
         [HttpPost("whatsapp")]
+        [Consumes("application/x-www-form-urlencoded")]
         public async Task<IActionResult> HandleWhatsAppMessage()
         {
             try
             {
                 var form = await Request.ReadFormAsync();
 
+                // Twilio signature validation
+                var authToken = _config["Twilio:AuthToken"];
+                var validator = new RequestValidator(authToken);
+                var url = $"{Request.Scheme}://{Request.Host}{Request.Path}{Request.QueryString}";
+                var signature = Request.Headers["X-Twilio-Signature"].ToString();
+                if (!validator.Validate(url, form, signature))
+                {
+                    return Unauthorized();
+                }
+
                 var from = form["From"].ToString();
                 var body = form["Body"].ToString();
                 var messageId = form["MessageSid"].ToString();
 
                 var responseText = await _whatsAppChatService.HandleIncomingMessageAsync(from, body);
                 await _twilioService.SendWhatsAppMessageAsync(from, responseText);
                 var twimlResponse = GenerateTwiMLResponse();
 
                 return Content(twimlResponse, "application/xml");
             }
-            catch (Exception ex)
+            catch (Exception)
             {
-                return StatusCode(500, $"Internal server error {ex.Message}");
+                // Return minimal TwiML to avoid retries; log server-side instead of exposing details
+                return Content(GenerateTwiMLResponse(), "application/xml");
             }
         }

-  <PackageReference Include="Twilio" Version="7.12.0" />
+  <PackageReference Include="Twilio" Version="8.1.1" />
   <PackageReference Include="Twilio.AspNet.Core" Version="8.1.1" />
-  <PackageReference Include="Twilio.AspNet.Mvc" Version="8.1.1" />

-            services.AddTransient<IChatAppService, ChatAppService>();
             services.AddSingleton<IMemoryDraftStore, MemoryDraftStore>();
             services.AddTransient<ITwilioService, TwilioService>();
             services.AddHttpClient<IChatAppService, ChatAppService>();

-            services.AddSingleton<IMemoryDraftStore, MemoryDraftStore>();

-        _apiKey = config["OpenAI:ApiKey"] ?? throw new ArgumentNullException("API key missing");
+        _apiKey = config["OpenAI:ApiKey"] ?? throw new InvalidOperationException("OpenAI API key is not configured");

-        var request = new HttpRequestMessage(HttpMethod.Post, "https://api.openai.com/v1/chat/completions");
-        request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", _apiKey);
-        request.Content = new StringContent(JsonConvert.SerializeObject(requestBody), Encoding.UTF8, "application/json");
-
-        var response = await _httpClient.SendAsync(request);
+        using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.openai.com/v1/chat/completions");
+        request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", _apiKey);
+        request.Content = new StringContent(JsonConvert.SerializeObject(requestBody), Encoding.UTF8, "application/json");
+
+        var response = await _httpClient.SendAsync(request);

-        var response = await _httpClient.SendAsync(request);
-        response.EnsureSuccessStatusCode();
-
-        var json = await response.Content.ReadAsStringAsync();
-        var openAiResponse = JsonConvert.DeserializeObject<OpenAiResponse>(json);
+        try
+        {
+            var response = await _httpClient.SendAsync(request);
+            response.EnsureSuccessStatusCode();
+
+            var json = await response.Content.ReadAsStringAsync();
+            var openAiResponse = JsonConvert.DeserializeObject<OpenAiResponse>(json);
+        }
+        catch (HttpRequestException ex)
+        {
+            // Log the error and return a user-friendly message
+            throw new InvalidOperationException("Failed to communicate with AI service. Please try again later.", ex);
+        }
+        catch (JsonException ex)
+        {
+            // Log the error
+            throw new InvalidOperationException("Invalid response from AI service.", ex);
+        }

-        catch
+        catch (Exception ex)
         {
+            // _logger.LogWarning(ex, "Failed to parse AI response JSON");
             return oldDraft;
         }