make sure to set up a
secret token check in your route handler headers. without it, anyone who finds the endpoint can spam your twilio account and rack up huge costs.
it's basically an open invitation for bots . i usually use a simple
if (req.headers['x-auth-token'] !== process.env.WEBFLOW_SECRET)
check to prevent this. also, keep the payload small so you don't hit any execution limits on the cloud function.