You can secure the assistant-request endpoint by verifying the request signature or secret that Vapi sends with each webhook. Basically, only process requests that come from Vapi itself — for example, using an HMAC check with your webhook secret. You can also add extra layers like HTTPS, auth tokens, or IP allowlisting if you want tighter control. @Ben R