diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96d80f9..85164c4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
           cache-dependency-path: "package-lock.json"
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install --package-lock=false
 
       - name: Lint
         run: npm run lint
diff --git a/eslint.config.js b/eslint.config.js
index 5f6121d..00088bb 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -33,8 +33,8 @@ module.exports = [
         it: 'readonly',
         expect: 'readonly',
         beforeAll: 'readonly',
-        afterAll: 'readonly',
         beforeEach: 'readonly',
+        afterAll: 'readonly',
         afterEach: 'readonly',
       },
     },
diff --git a/src/__tests__/auth.test.js b/src/__tests__/auth.test.js
index c0af686..2f91662 100644
--- a/src/__tests__/auth.test.js
+++ b/src/__tests__/auth.test.js
@@ -1,83 +1,83 @@
-const request = require('supertest');
-const jwt = require('jsonwebtoken');
-const app = require('../index'); // Adjust if needed based on index.js exports
-
-describe('Authentication Middleware', () => {
-    const secret = process.env.JWT_SECRET || 'test-secret';
-    const validPayload = { id: 1, role: 'user' };
-    let validToken;
-    let expiredToken;
-
-    beforeAll(() => {
-        validToken = jwt.sign(validPayload, secret, { expiresIn: '1h' });
-        expiredToken = jwt.sign(validPayload, secret, { expiresIn: '-1h' });
-    });
-
-    describe('Route Protection - POST /api/invoices', () => {
-        it('should return 401 when no token is provided', async () => {
-            const response = await request(app).post('/api/invoices').send({});
-            expect(response.status).toBe(401);
-            expect(response.body.error).toBe('Authentication token is required');
-        });
-
-        it('should return 401 when token format is invalid (missing Bearer)', async () => {
-            const response = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', `FakeBearer ${validToken}`)
-                .send({});
-            expect(response.status).toBe(401);
-            expect(response.body.error).toBe('Invalid Authorization header format. Expected "Bearer <token>"');
-        });
-
-        it('should return 401 when authorization header is malformed (no space)', async () => {
-            const response = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', `Bearer${validToken}`)
-                .send({});
-            expect(response.status).toBe(401);
-            expect(response.body.error).toBe('Invalid Authorization header format. Expected "Bearer <token>"');
-        });
-
-        it('should return 401 when token is invalid', async () => {
-            const response = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', 'Bearer some.invalid.token')
-                .send({});
-            expect(response.status).toBe(401);
-            expect(response.body.error).toBe('Invalid token');
-        });
-
-        it('should return 401 when token is expired', async () => {
-            const response = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', `Bearer ${expiredToken}`)
-                .send({});
-            expect(response.status).toBe(401);
-            expect(response.body.error).toBe('Token has expired');
-        });
-
-        it('should return 201 when a valid token is provided', async () => {
-            const response = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', `Bearer ${validToken}`)
-                .send({ amount: 1000, customer: 'Test Corp' });
-            expect(response.status).toBe(201);
-            expect(response.body.data).toHaveProperty('id');
-        });
-    });
-
-    describe('Route Protection - GET /api/escrow/:invoiceId', () => {
-        it('should allow escrow read with valid token', async () => {
-            const response = await request(app)
-                .get('/api/escrow/test-invoice')
-                .set('Authorization', `Bearer ${validToken}`);
-            expect(response.status).toBe(200);
-            expect(response.body.data.invoiceId).toBe('test-invoice');
-        });
-
-        it('should reject escrow read without token', async () => {
-            const response = await request(app).get('/api/escrow/test-invoice');
-            expect(response.status).toBe(401);
-        });
-    });
-});
+const request = require('supertest');
+const jwt = require('jsonwebtoken');
+const app = require('../index'); // Adjust if needed based on index.js exports
+
+describe('Authentication Middleware', () => {
+    const secret = process.env.JWT_SECRET || 'test-secret';
+    const validPayload = { id: 1, role: 'user' };
+    let validToken;
+    let expiredToken;
+
+    beforeAll(() => {
+        validToken = jwt.sign(validPayload, secret, { expiresIn: '1h' });
+        expiredToken = jwt.sign(validPayload, secret, { expiresIn: '-1h' });
+    });
+
+    describe('Route Protection - POST /api/invoices', () => {
+        it('should return 401 when no token is provided', async () => {
+            const response = await request(app).post('/api/invoices').send({});
+            expect(response.status).toBe(401);
+            expect(response.body.error).toBe('Authentication token is required');
+        });
+
+        it('should return 401 when token format is invalid (missing Bearer)', async () => {
+            const response = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', `FakeBearer ${validToken}`)
+                .send({});
+            expect(response.status).toBe(401);
+            expect(response.body.error).toBe('Invalid Authorization header format. Expected "Bearer <token>"');
+        });
+
+        it('should return 401 when authorization header is malformed (no space)', async () => {
+            const response = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', `Bearer${validToken}`)
+                .send({});
+            expect(response.status).toBe(401);
+            expect(response.body.error).toBe('Invalid Authorization header format. Expected "Bearer <token>"');
+        });
+
+        it('should return 401 when token is invalid', async () => {
+            const response = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', 'Bearer some.invalid.token')
+                .send({});
+            expect(response.status).toBe(401);
+            expect(response.body.error).toBe('Invalid token');
+        });
+
+        it('should return 401 when token is expired', async () => {
+            const response = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', `Bearer ${expiredToken}`)
+                .send({});
+            expect(response.status).toBe(401);
+            expect(response.body.error).toBe('Token has expired');
+        });
+
+        it('should return 201 when a valid token is provided', async () => {
+            const response = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', `Bearer ${validToken}`)
+                .send({ amount: 1000, customer: 'Test Corp' });
+            expect(response.status).toBe(201);
+            expect(response.body.data).toHaveProperty('id');
+        });
+    });
+
+    describe('Route Protection - GET /api/escrow/:invoiceId', () => {
+        it('should allow escrow read with valid token', async () => {
+            const response = await request(app)
+                .get('/api/escrow/test-invoice')
+                .set('Authorization', `Bearer ${validToken}`);
+            expect(response.status).toBe(200);
+            expect(response.body.data.invoiceId).toBe('test-invoice');
+        });
+
+        it('should reject escrow read without token', async () => {
+            const response = await request(app).get('/api/escrow/test-invoice');
+            expect(response.status).toBe(401);
+        });
+    });
+});
diff --git a/src/__tests__/bodySizeLimits.test.js b/src/__tests__/bodySizeLimits.test.js
index a12b0d8..0bfd941 100644
--- a/src/__tests__/bodySizeLimits.test.js
+++ b/src/__tests__/bodySizeLimits.test.js
@@ -441,8 +441,7 @@ describe('computeBackoff()', () => {
   });
   it('increases with attempt number', () => {
     const d3 = computeBackoff(3, 200, 5000);
-    // With jitter d3 is almost certainly larger; we check average tendency
-    expect(200 * 2 ** 3).toBeGreaterThan(200); // sanity
+    expect(d3).toBeGreaterThanOrEqual(d0);
     expect(d3).toBeLessThanOrEqual(5000);
   });
   it('is capped at maxDelay', () => {
@@ -689,4 +688,4 @@ describe('createApp() integration', () => {
     // GET is not affected; the 100 KB global limit only applies to bodies.
     expect(res.status).toBe(200);
   });
-});
\ No newline at end of file
+});
diff --git a/src/__tests__/invoice.api.test.js b/src/__tests__/invoice.api.test.js
index 52445b6..4b4209f 100644
--- a/src/__tests__/invoice.api.test.js
+++ b/src/__tests__/invoice.api.test.js
@@ -1,9 +1,11 @@
 const request = require('supertest');
 const { createApp } = require('../app');
-const invoiceService = require('../services/invoice.service');
 
-// Mock the service
-jest.mock('../services/invoice.service');
+jest.mock('../services/invoice.service', () => ({
+  getInvoices: jest.fn(),
+}));
+
+const invoiceService = require('../services/invoice.service');
 
 describe('Invoice API Integration', () => {
   let app;
diff --git a/src/__tests__/rateLimit.test.js b/src/__tests__/rateLimit.test.js
index 04f4df6..6d5219c 100644
--- a/src/__tests__/rateLimit.test.js
+++ b/src/__tests__/rateLimit.test.js
@@ -1,36 +1,36 @@
-const request = require('supertest');
-const jwt = require('jsonwebtoken');
-const app = require('../index');
-
-describe('Rate Limiting Middleware', () => {
-    const secret = process.env.JWT_SECRET || 'test-secret';
-    const validToken = jwt.sign({ id: 'test_user_1' }, secret);
-    const validBody = { amount: 100, customer: 'Rate Test Corp' };
-
-    it('should return 200 for health check (global limiter allows many)', async () => {
-        const response = await request(app).get('/health');
-        expect(response.status).toBe(200);
-        expect(response.headers).toHaveProperty('ratelimit-limit');
-    });
-
-    describe('Sensitive Operations Throttling - POST /api/invoices', () => {
-        it('should allow up to 10 requests and then return 429 Too Many Requests', async () => {
-            for (let i = 0; i < 10; i++) {
-                const response = await request(app)
-                    .post('/api/invoices')
-                    .set('Authorization', `Bearer ${validToken}`)
-                    .send(validBody);
-                if (response.status === 429) {
-                    break;
-                }
-                expect(response.status).toBe(201);
-            }
-            const throttledResponse = await request(app)
-                .post('/api/invoices')
-                .set('Authorization', `Bearer ${validToken}`)
-                .send(validBody);
-            expect(throttledResponse.status).toBe(429);
-            expect(throttledResponse.body.error).toContain('rate limit exceeded');
-        });
-    });
-});
+const request = require('supertest');
+const jwt = require('jsonwebtoken');
+const app = require('../index');
+
+describe('Rate Limiting Middleware', () => {
+    const secret = process.env.JWT_SECRET || 'test-secret';
+    const validToken = jwt.sign({ id: 'test_user_1' }, secret);
+    const validBody = { amount: 100, customer: 'Rate Test Corp' };
+
+    it('should return 200 for health check (global limiter allows many)', async () => {
+        const response = await request(app).get('/health');
+        expect(response.status).toBe(200);
+        expect(response.headers).toHaveProperty('ratelimit-limit');
+    });
+
+    describe('Sensitive Operations Throttling - POST /api/invoices', () => {
+        it('should allow up to 10 requests and then return 429 Too Many Requests', async () => {
+            for (let i = 0; i < 10; i++) {
+                const response = await request(app)
+                    .post('/api/invoices')
+                    .set('Authorization', `Bearer ${validToken}`)
+                    .send(validBody);
+                if (response.status === 429) {
+                    break;
+                }
+                expect(response.status).toBe(201);
+            }
+            const throttledResponse = await request(app)
+                .post('/api/invoices')
+                .set('Authorization', `Bearer ${validToken}`)
+                .send(validBody);
+            expect(throttledResponse.status).toBe(429);
+            expect(throttledResponse.body.error).toContain('rate limit exceeded');
+        });
+    });
+});
diff --git a/src/app.js b/src/app.js
index b4d86ee..4fc7a83 100644
--- a/src/app.js
+++ b/src/app.js
@@ -104,8 +104,6 @@ const invoiceService                        = require('./services/invoice.servic
 const { createCorsOptions, isCorsOriginRejectedError } = require('./config/cors');
 const { validateInvoiceQueryParams }                  = require('./utils/validators');
 const {
-  jsonBodyLimit,
-  urlencodedBodyLimit,
   invoiceBodyLimit,
   payloadTooLargeHandler,
 } = require('./middleware/bodySizeLimits');
@@ -137,7 +135,24 @@ function handleCorsError(err, req, res, next) {
  * @returns {void}
  */
 function handleInternalError(err, req, res, _next) {
+  const isDevelopment = process.env.NODE_ENV === 'development';
+
+  if (err && (err.type === 'entity.parse.failed' || err.status === 400)) {
+    res.status(400).json({ error: 'Bad Request' });
+    return;
+  }
+
   console.error(err);
+  if (isDevelopment) {
+    res.status(500).json({
+      error: {
+        message: err && err.message ? err.message : 'Internal server error',
+        stack: err && err.stack ? err.stack : null,
+      },
+    });
+    return;
+  }
+
   res.status(500).json({ error: 'Internal server error' });
 }
 
@@ -237,6 +252,14 @@ function createApp() {
     next(new Error('Simulated server error'));
   });
 
+  app.get('/debug/error', (req, res, next) => {
+    next(new Error('Triggered Error'));
+  });
+
+  app.get('/prod-error', (req, res, next) => {
+    next(new Error('Sensitive'));
+  });
+
   // ── 5. 404 catch-all ─────────────────────────────────────────────────────
   app.use((req, res) => {
     res.status(404).json({ error: 'Not found', path: req.path });
@@ -250,8 +273,117 @@ function createApp() {
   return app;
 }
 
-module.exports = {
-  createApp,
-  handleCorsError,
-  handleInternalError,
-};
+/**
+ * Maps HTTP status to default API error code.
+ *
+ * @param {number} statusCode - HTTP status code.
+ * @returns {string} Standardized error code.
+ */
+function getErrorCode(statusCode) {
+  if (statusCode === 400) {
+    return 'BAD_REQUEST';
+  }
+  if (statusCode === 401) {
+    return 'UNAUTHORIZED';
+  }
+  if (statusCode === 403) {
+    return 'FORBIDDEN';
+  }
+  if (statusCode === 404) {
+    return 'NOT_FOUND';
+  }
+  return 'INTERNAL_ERROR';
+}
+
+/**
+ * Builds a standardized envelope from an outgoing JSON payload.
+ *
+ * @param {number} statusCode - Response status code.
+ * @param {unknown} payload - Outgoing payload.
+ * @returns {Object} Standardized response envelope.
+ */
+function toStandardEnvelope(statusCode, payload) {
+  const isDev = process.env.NODE_ENV === 'development';
+  const isObjectPayload = payload !== null && typeof payload === 'object';
+
+  if (
+    isObjectPayload &&
+    Object.prototype.hasOwnProperty.call(payload, 'data') &&
+    Object.prototype.hasOwnProperty.call(payload, 'meta') &&
+    Object.prototype.hasOwnProperty.call(payload, 'error')
+  ) {
+    return payload;
+  }
+
+  if (statusCode < 400) {
+    const data =
+      isObjectPayload && Object.prototype.hasOwnProperty.call(payload, 'data')
+        ? payload.data
+        : payload;
+    return responseHelper.success(data);
+  }
+
+  const payloadError =
+    isObjectPayload && Object.prototype.hasOwnProperty.call(payload, 'error')
+      ? payload.error
+      : null;
+
+  let message = 'Internal server error';
+  if (typeof payloadError === 'string') {
+    message = payloadError;
+  } else if (payloadError && typeof payloadError.message === 'string') {
+    message = payloadError.message;
+  } else if (isObjectPayload && typeof payload.message === 'string') {
+    message = payload.message;
+  }
+
+  if (statusCode >= 500 && !isDev) {
+    message = 'Internal server error';
+  }
+
+  const details = isDev
+    ? (payloadError && payloadError.stack) ||
+      (payloadError && payloadError.details) ||
+      (isObjectPayload && payload.stack) ||
+      (isObjectPayload && payload.message) ||
+      message
+    : null;
+
+  return responseHelper.error(message, getErrorCode(statusCode), details);
+}
+
+/**
+ * Creates app instance that always returns standardized response envelopes.
+ *
+ * @returns {import('express').Express} Standardized app instance.
+ */
+function createStandardizedApp() {
+  const standardizedApp = express();
+  const rawApp = createApp();
+
+  standardizedApp.use((req, res, next) => {
+    const originalJson = res.json.bind(res);
+    /**
+     * Wraps outgoing JSON payloads in the standard response envelope.
+     *
+     * @param {unknown} payload - Outgoing JSON payload.
+     * @returns {import('express').Response} Express response.
+     */
+    res.json = function sendEnvelopedJson(payload) {
+      const envelope = toStandardEnvelope(res.statusCode, payload);
+      return originalJson(envelope);
+    };
+    next();
+  });
+
+  standardizedApp.use(rawApp);
+  return standardizedApp;
+}
+
+const app = createStandardizedApp();
+
+module.exports = app;
+module.exports.createApp = createApp;
+module.exports.createStandardizedApp = createStandardizedApp;
+module.exports.handleCorsError = handleCorsError;
+module.exports.handleInternalError = handleInternalError;
diff --git a/src/app.test.js b/src/app.test.js
index e806b16..075309b 100644
--- a/src/app.test.js
+++ b/src/app.test.js
@@ -1,12 +1,14 @@
 const cors = require('cors');
 
+jest.mock('./services/invoice.service', () => ({
+  getInvoices: jest.fn(),
+}));
+
 const { createApp, handleCorsError } = require('./app');
 const { CORS_REJECTION_MESSAGE } = require('./config/cors');
 const { createCorsOptions } = require('./config/cors');
 const invoiceService = require('./services/invoice.service');
 
-jest.mock('./services/invoice.service');
-
 function withEnv(env, fn) {
   const previousValues = new Map();
 
@@ -311,6 +313,19 @@ describe('LiquiFact app integration', () => {
     });
   });
 
+  it('sanitizes route params before escrow lookup', async () => {
+    const response = await invokeApp(createApp(), {
+      path: '/api/escrow/%20invoice-123%0A',
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.body.data).toEqual({
+      invoiceId: 'invoice-123',
+      status: 'not_found',
+      fundedAmount: 0,
+    });
+  });
+
   it('returns 404 for unknown routes', async () => {
     const response = await invokeApp(createApp(), {
       path: '/missing',
diff --git a/src/config/cors.js b/src/config/cors.js
index 2cc491a..090bb6e 100644
--- a/src/config/cors.js
+++ b/src/config/cors.js
@@ -104,7 +104,9 @@ function resolveAllowlist(env) {
 function createCorsRejectionError(_origin) {
   const err = new Error(CORS_REJECTION_MESSAGE);
   err.isCorsOriginRejected = true;
+  err.isCorsOriginRejectedError = true;
   err.status = 403;
+  err.origin = origin;
   return err;
 }
 
diff --git a/src/index.js b/src/index.js
index 5f16f08..86128b6 100644
--- a/src/index.js
+++ b/src/index.js
@@ -22,6 +22,10 @@ const { globalLimiter, sensitiveLimiter } = require('./middleware/rateLimit');
 const { authenticateToken } = require('./middleware/auth');
 const asyncHandler = require('./utils/asyncHandler');
 const errorHandler = require('./middleware/errorHandler');
+const { authenticateToken } = require('./middleware/auth');
+const { globalLimiter, sensitiveLimiter } = require('./middleware/rateLimit');
+const { sanitizeInput } = require('./middleware/sanitizeInput');
+const { createSecurityMiddleware } = require('./middleware/security');
 const { callSorobanContract } = require('./services/soroban');
 const AppError = require('./errors/AppError');
 
@@ -237,7 +241,7 @@ const app = createApp({ enableTestRoutes: process.env.NODE_ENV === 'test' });
 app.use(errorHandler);
 
 /**
- * Starts the Express server.
+ * Starts the HTTP server.
  *
  * @returns {import('http').Server}
  */
@@ -249,7 +253,7 @@ const startServer = () => {
 };
 
 /**
- * Resets the in-memory store (for testing purposes).
+ * Resets the in-memory invoice collection for tests.
  *
  * @returns {void}
  */
diff --git a/src/index.test.js b/src/index.test.js
index 32f93e7..af1147c 100644
--- a/src/index.test.js
+++ b/src/index.test.js
@@ -149,6 +149,7 @@ describe('LiquiFact API', () => {
     });
 
     it('DELETE /api/invoices/:id - soft deletes an invoice', async () => {
+      const bearer = authHeader();
       const postRes = await request(app)
         .post('/api/invoices')
         .set(authHeader)
@@ -225,6 +226,37 @@ describe('LiquiFact API', () => {
       expect(response.status).toBe(200);
       expect(response.body.data).toHaveProperty('invoiceId', '123');
     });
+
+    it('POST /api/escrow - sanitizes user-supplied fields', async () => {
+      const response = await request(app)
+        .post('/api/escrow')
+        .set('Authorization', authHeader())
+        .send({ invoiceId: '  abc-123 \n', fundedAmount: 10 });
+
+      expect(response.status).toBe(200);
+      expect(response.body.data).toHaveProperty('invoiceId', 'abc-123');
+    });
+  });
+
+  describe('Sanitization', () => {
+    it('POST /api/invoices - normalizes customer input before persistence', async () => {
+      const response = await request(app)
+        .post('/api/invoices')
+        .set('Authorization', authHeader())
+        .send({ amount: 1000, customer: '  ACME \n Holdings \u0000 ' });
+
+      expect(response.status).toBe(201);
+      expect(response.body.data.customer).toBe('ACME Holdings');
+    });
+
+    it('POST /api/invoices - rejects missing token before processing payload', async () => {
+      const response = await request(app)
+        .post('/api/invoices')
+        .send({ amount: 1000, customer: '  ACME \n Holdings \u0000 ' });
+
+      expect(response.status).toBe(401);
+      expect(response.body.error.message).toBe('Authentication token is required');
+    });
   });
 
   describe('Server', () => {
@@ -249,6 +281,20 @@ describe('LiquiFact API', () => {
 // ---------------------------------------------------------------------------
 
 describe('Security headers — all endpoints', () => {
+  /**
+   * Asserts the security headers applied by Helmet.
+   *
+   * @param {import('supertest').Response} res - HTTP response.
+   * @returns {void}
+   */
+  const expectSecureHeaders = (res) => {
+    expect(res.headers['content-security-policy']).toBeDefined();
+    expect(res.headers['strict-transport-security']).toBeDefined();
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.headers['x-frame-options']).toBe('DENY');
+    expect(res.headers['referrer-policy']).toBeDefined();
+  };
+
   const endpoints = [
     { method: 'get', path: '/health' },
     { method: 'get', path: '/api' },
diff --git a/src/middleware/auth.js b/src/middleware/auth.js
index 707a93d..f0f4c79 100644
--- a/src/middleware/auth.js
+++ b/src/middleware/auth.js
@@ -1,49 +1,49 @@
-/**
- * Authentication Middleware
- * Validates JWT tokens in the Authorization header.
- * @module middleware/auth
- */
-
-const jwt = require('jsonwebtoken');
-
-/**
- * Middleware function to enforce authentication for protected routes.
- * It checks the "Authorization" header for a "Bearer <token>" pattern.
- * If valid, it attaches the decoded token payload to `req.user`.
- * 
- * @param {import('express').Request} req - Express request object
- * @param {import('express').Response} res - Express response object
- * @param {import('express').NextFunction} next - Express next middleware function
- * @returns {void}
- */
-const authenticateToken = (req, res, next) => {
-  const authHeader = req.headers['authorization'];
-  
-  if (!authHeader) {
-    return res.status(401).json({ error: 'Authentication token is required' });
-  }
-
-  const tokenParts = authHeader.split(' ');
-  
-  if (tokenParts.length !== 2 || tokenParts[0] !== 'Bearer') {
-    return res.status(401).json({ error: 'Invalid Authorization header format. Expected "Bearer <token>"' });
-  }
-
-  const token = tokenParts[1];
-  const secret = process.env.JWT_SECRET || 'test-secret'; // Fallback for local testing if env is not completely set
-
-  jwt.verify(token, secret, (err, decoded) => {
-    if (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token has expired' });
-      }
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Attach user info to the request pattern
-    req.user = decoded;
-    next();
-  });
-};
-
-module.exports = { authenticateToken };
+/**
+ * Authentication Middleware
+ * Validates JWT tokens in the Authorization header.
+ * @module middleware/auth
+ */
+
+const jwt = require('jsonwebtoken');
+
+/**
+ * Middleware function to enforce authentication for protected routes.
+ * It checks the "Authorization" header for a "Bearer <token>" pattern.
+ * If valid, it attaches the decoded token payload to `req.user`.
+ * 
+ * @param {import('express').Request} req - Express request object
+ * @param {import('express').Response} res - Express response object
+ * @param {import('express').NextFunction} next - Express next middleware function
+ * @returns {void}
+ */
+const authenticateToken = (req, res, next) => {
+  const authHeader = req.headers['authorization'];
+  
+  if (!authHeader) {
+    return res.status(401).json({ error: 'Authentication token is required' });
+  }
+
+  const tokenParts = authHeader.split(' ');
+  
+  if (tokenParts.length !== 2 || tokenParts[0] !== 'Bearer') {
+    return res.status(401).json({ error: 'Invalid Authorization header format. Expected "Bearer <token>"' });
+  }
+
+  const token = tokenParts[1];
+  const secret = process.env.JWT_SECRET || 'test-secret'; // Fallback for local testing if env is not completely set
+
+  jwt.verify(token, secret, (err, decoded) => {
+    if (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token has expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Attach user info to the request pattern
+    req.user = decoded;
+    next();
+  });
+};
+
+module.exports = { authenticateToken };
diff --git a/src/middleware/bodySizeLimits.js b/src/middleware/bodySizeLimits.js
index fddb6a3..f6a0905 100644
--- a/src/middleware/bodySizeLimits.js
+++ b/src/middleware/bodySizeLimits.js
@@ -170,9 +170,12 @@ function urlencodedBodyLimit(limit) {
  */
 function payloadTooLargeHandler(err, req, res, next) {
   if (err.type === 'entity.too.large') {
+    const limitValue = typeof err.limit === 'number' ? `${err.limit}b` : 'unknown';
+
     return res.status(413).json({
       error: 'Payload Too Large',
       message: 'Request body exceeds the maximum allowed size.',
+      limit: limitValue,
       path: req.path,
     });
   }
@@ -202,4 +205,4 @@ module.exports = {
   urlencodedBodyLimit,
   payloadTooLargeHandler,
   invoiceBodyLimit,
-};
\ No newline at end of file
+};
diff --git a/src/middleware/rateLimit.js b/src/middleware/rateLimit.js
index a887f3d..d293a1f 100644
--- a/src/middleware/rateLimit.js
+++ b/src/middleware/rateLimit.js
@@ -1,56 +1,56 @@
-/**
- * Rate Limiting Middleware
- * Protects endpoints from abuse and DoS using IP and token-based limiting.
- */
-
-const { rateLimit, ipKeyGenerator } = require('express-rate-limit');
-
-/**
- * Standard global rate limiter for all API endpoints.
- * Limits each IP to 100 requests per 15 minutes.
- */
-const globalLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  limit: 100,
-  message: {
-    error: 'Too many requests from this IP, please try again after 15 minutes',
-  },
-  standardHeaders: true,
-  legacyHeaders: false,
-  /**
-   * Generates a rate-limit key per user ID or IP address.
-   * @param {import('express').Request} req - Express request object
-   * @returns {string} The rate-limit key
-   */
-  keyGenerator: (req) => {
-    // Use user ID if authenticated, otherwise fallback to safe IP generator
-    return req.user ? `user_${req.user.id}` : ipKeyGenerator(req.ip);
-  },
-});
-
-/**
- * Stricter limiter for sensitive operations (Invoices, Escrow).
- * Limits each IP or user to 10 requests per hour.
- */
-const sensitiveLimiter = rateLimit({
-  windowMs: 60 * 60 * 1000,
-  limit: 10,
-  message: {
-    error: 'Strict rate limit exceeded for sensitive operations. Please try again later.',
-  },
-  standardHeaders: true,
-  legacyHeaders: false,
-  /**
-   * Generates a rate-limit key per user ID or IP address.
-   * @param {import('express').Request} req - Express request object
-   * @returns {string} The rate-limit key
-   */
-  keyGenerator: (req) => {
-    return req.user ? `user_${req.user.id}` : ipKeyGenerator(req.ip);
-  },
-});
-
-module.exports = {
-  globalLimiter,
-  sensitiveLimiter,
-};
+/**
+ * Rate Limiting Middleware
+ * Protects endpoints from abuse and DoS using IP and token-based limiting.
+ */
+
+const { rateLimit, ipKeyGenerator } = require('express-rate-limit');
+
+/**
+ * Standard global rate limiter for all API endpoints.
+ * Limits each IP to 100 requests per 15 minutes.
+ */
+const globalLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 100,
+  message: {
+    error: 'Too many requests from this IP, please try again after 15 minutes',
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+  /**
+   * Generates a rate-limit key per user ID or IP address.
+   * @param {import('express').Request} req - Express request object
+   * @returns {string} The rate-limit key
+   */
+  keyGenerator: (req) => {
+    // Use user ID if authenticated, otherwise fallback to safe IP generator
+    return req.user ? `user_${req.user.id}` : ipKeyGenerator(req.ip);
+  },
+});
+
+/**
+ * Stricter limiter for sensitive operations (Invoices, Escrow).
+ * Limits each IP or user to 10 requests per hour.
+ */
+const sensitiveLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000,
+  limit: 10,
+  message: {
+    error: 'Strict rate limit exceeded for sensitive operations. Please try again later.',
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+  /**
+   * Generates a rate-limit key per user ID or IP address.
+   * @param {import('express').Request} req - Express request object
+   * @returns {string} The rate-limit key
+   */
+  keyGenerator: (req) => {
+    return req.user ? `user_${req.user.id}` : ipKeyGenerator(req.ip);
+  },
+});
+
+module.exports = {
+  globalLimiter,
+  sensitiveLimiter,
+};
diff --git a/src/middleware/sanitizeInput.js b/src/middleware/sanitizeInput.js
new file mode 100644
index 0000000..02310e0
--- /dev/null
+++ b/src/middleware/sanitizeInput.js
@@ -0,0 +1,68 @@
+const { sanitizeValue } = require('../utils/sanitization');
+
+/**
+ * Express middleware that sanitizes common user-supplied input containers.
+ *
+ * The middleware mutates request references with sanitized copies so downstream
+ * handlers always receive normalized values.
+ *
+ * @param {import('express').Request} req Express request.
+ * @param {import('express').Response} _res Express response.
+ * @param {import('express').NextFunction} next Express next callback.
+ * @returns {void}
+ */
+function sanitizeInput(req, _res, next) {
+  req.body = sanitizeValue(req.body);
+
+  let sanitizedQuery = sanitizeValue(req.query);
+  Object.defineProperty(req, 'query', {
+    configurable: true,
+    enumerable: true,
+    /**
+     * Gets the sanitized query object.
+     *
+     * @returns {object} Sanitized query object.
+     */
+    get() {
+      return sanitizedQuery;
+    },
+    /**
+     * Re-sanitizes the query object when Express reassigns it.
+     *
+     * @param {object} value New query object.
+     * @returns {void}
+     */
+    set(value) {
+      sanitizedQuery = sanitizeValue(value);
+    },
+  });
+
+  let sanitizedParams = sanitizeValue(req.params);
+  Object.defineProperty(req, 'params', {
+    configurable: true,
+    enumerable: true,
+    /**
+     * Gets sanitized route params.
+     *
+     * @returns {object} Sanitized params.
+     */
+    get() {
+      return sanitizedParams;
+    },
+    /**
+     * Re-sanitizes route params when Express updates them.
+     *
+     * @param {object} value New params object.
+     * @returns {void}
+     */
+    set(value) {
+      sanitizedParams = sanitizeValue(value);
+    },
+  });
+
+  next();
+}
+
+module.exports = {
+  sanitizeInput,
+};
diff --git a/src/middleware/sanitizeInput.test.js b/src/middleware/sanitizeInput.test.js
new file mode 100644
index 0000000..aa36a4a
--- /dev/null
+++ b/src/middleware/sanitizeInput.test.js
@@ -0,0 +1,63 @@
+const request = require('supertest');
+const express = require('express');
+const { sanitizeInput } = require('./sanitizeInput');
+
+describe('sanitizeInput middleware', () => {
+  let app;
+
+  beforeEach(() => {
+    app = express();
+    app.use(express.json());
+    app.use(sanitizeInput);
+
+    app.post('/echo/:invoiceId', (req, res) => {
+      res.json({
+        body: req.body,
+        query: req.query,
+        params: req.params,
+      });
+    });
+  });
+
+  it('sanitizes params, query, and body before handlers run', async () => {
+    const response = await request(app)
+      .post('/echo/%20inv-123%0A?customer=%20%20ACME%09')
+      .send({
+        customer: '  ACME \n LTD  ',
+        invoice: {
+          note: '\u0000 very  important ',
+        },
+      });
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({
+      body: {
+        customer: 'ACME LTD',
+        invoice: {
+          note: 'very important',
+        },
+      },
+      query: {
+        customer: 'ACME',
+      },
+      params: {
+        invoiceId: 'inv-123',
+      },
+    });
+  });
+
+  it('strips prototype-pollution keys from body payload', async () => {
+    const response = await request(app)
+      .post('/echo/inv-001')
+      .send({
+        customer: 'Test',
+        constructor: 'drop-me',
+        prototype: 'drop-me-too',
+      });
+
+    expect(response.status).toBe(200);
+    expect(response.body.body).toEqual({
+      customer: 'Test',
+    });
+  });
+});
diff --git a/src/services/soroban.js b/src/services/soroban.js
index 45bd7ef..aade8ec 100644
--- a/src/services/soroban.js
+++ b/src/services/soroban.js
@@ -106,6 +106,25 @@ function isRetryable(err) {
   return false;
 }
 
+/**
+ * Backward-compatible transient error detector based on message patterns.
+ *
+ * @param {unknown} err - Error thrown by the operation.
+ * @returns {boolean} True if message implies transient failure.
+ */
+function isTransientError(err) {
+  const message =
+    err && typeof err.message === 'string' ? err.message.toLowerCase() : '';
+  return (
+    message.includes('timeout') ||
+    message.includes('econnrefused') ||
+    message.includes('etimedout') ||
+    message.includes('network') ||
+    message.includes('503') ||
+    message.includes('429')
+  );
+}
+
 /**
  * Executes `operation` with automatic exponential-backoff retries for
  * transient Soroban / Horizon errors.
@@ -177,8 +196,9 @@ module.exports = {
   callSorobanContract,
   withRetry,
   computeBackoff,
+  isTransientError,
   isRetryable,
   isTransientError,
   SOROBAN_RETRY_CONFIG,
   RETRYABLE_STATUS_CODES,
-};
\ No newline at end of file
+};
diff --git a/src/utils/sanitization.js b/src/utils/sanitization.js
new file mode 100644
index 0000000..a934359
--- /dev/null
+++ b/src/utils/sanitization.js
@@ -0,0 +1,105 @@
+/**
+ * Input sanitization and normalization helpers for user-supplied data.
+ *
+ * The goal is to normalize strings consistently and reduce common abuse cases:
+ * - control-character/log-forging payloads
+ * - malformed unicode
+ * - prototype-pollution keys in object payloads
+ */
+
+const DANGEROUS_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+const DEFAULT_MAX_DEPTH = 20;
+const DEFAULT_MAX_STRING_LENGTH = 4096;
+
+/**
+ * Sanitizes and normalizes a user-supplied string.
+ *
+ * @param {string} value Raw user string.
+ * @param {object} [options] String sanitization options.
+ * @param {number} [options.maxLength=4096] Maximum normalized string length.
+ * @returns {string} Normalized safe string.
+ */
+function sanitizeUserString(value, options = {}) {
+  const maxLength = Number.isInteger(options.maxLength)
+    ? options.maxLength
+    : DEFAULT_MAX_STRING_LENGTH;
+
+  const normalized = value
+    .normalize('NFKC')
+    // Remove non-printable control characters while preserving readability.
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, '')
+    // Prevent log/header injection via CRLF and normalize odd spacing.
+    .replace(/\s+/g, ' ')
+    .trim();
+
+  return normalized.length > maxLength ? normalized.slice(0, maxLength) : normalized;
+}
+
+/**
+ * Recursively sanitizes a value tree.
+ *
+ * Strings are normalized, arrays are mapped, and objects are rebuilt with
+ * dangerous keys removed.
+ *
+ * @param {*} input Value to sanitize.
+ * @param {object} [options] Tree sanitization options.
+ * @param {number} [options.maxDepth=20] Maximum recursion depth.
+ * @param {number} [options.maxStringLength=4096] Maximum string length.
+ * @returns {*} Sanitized value tree.
+ */
+function sanitizeValue(input, options = {}) {
+  const maxDepth = Number.isInteger(options.maxDepth) ? options.maxDepth : DEFAULT_MAX_DEPTH;
+  const maxStringLength = Number.isInteger(options.maxStringLength)
+    ? options.maxStringLength
+    : DEFAULT_MAX_STRING_LENGTH;
+
+  return sanitizeValueAtDepth(input, 0, { maxDepth, maxStringLength });
+}
+
+/**
+ * Internal recursive sanitizer.
+ *
+ * @param {*} input Value to sanitize.
+ * @param {number} depth Current recursion depth.
+ * @param {{ maxDepth: number, maxStringLength: number }} options Sanitization options.
+ * @returns {*} Sanitized value.
+ */
+function sanitizeValueAtDepth(input, depth, options) {
+  if (depth > options.maxDepth) {
+    return undefined;
+  }
+
+  if (typeof input === 'string') {
+    return sanitizeUserString(input, { maxLength: options.maxStringLength });
+  }
+
+  if (Array.isArray(input)) {
+    return input
+      .map((item) => sanitizeValueAtDepth(item, depth + 1, options))
+      .filter((item) => item !== undefined);
+  }
+
+  if (input && typeof input === 'object') {
+    const sanitizedObject = {};
+
+    for (const [key, value] of Object.entries(input)) {
+      if (DANGEROUS_KEYS.has(key)) {
+        continue;
+      }
+
+      const sanitizedValue = sanitizeValueAtDepth(value, depth + 1, options);
+      if (sanitizedValue !== undefined) {
+        sanitizedObject[key] = sanitizedValue;
+      }
+    }
+
+    return sanitizedObject;
+  }
+
+  return input;
+}
+
+module.exports = {
+  sanitizeUserString,
+  sanitizeValue,
+};
diff --git a/src/utils/sanitization.test.js b/src/utils/sanitization.test.js
new file mode 100644
index 0000000..58cb546
--- /dev/null
+++ b/src/utils/sanitization.test.js
@@ -0,0 +1,51 @@
+const { sanitizeUserString, sanitizeValue } = require('./sanitization');
+
+describe('sanitizeUserString', () => {
+  it('normalizes unicode, strips controls, collapses whitespace, and trims', () => {
+    const input = '  ACME\u0000 \n\t Corp  ';
+    const output = sanitizeUserString(input);
+
+    expect(output).toBe('ACME Corp');
+  });
+
+  it('caps string length', () => {
+    const output = sanitizeUserString('abcdefgh', { maxLength: 5 });
+    expect(output).toBe('abcde');
+  });
+});
+
+describe('sanitizeValue', () => {
+  it('recursively sanitizes nested strings and arrays', () => {
+    const input = {
+      customer: '  John \n Doe  ',
+      tags: ['  urgent ', ' \t vip  '],
+      metadata: {
+        note: '  paid\u0000today  ',
+      },
+    };
+
+    expect(sanitizeValue(input)).toEqual({
+      customer: 'John Doe',
+      tags: ['urgent', 'vip'],
+      metadata: {
+        note: 'paidtoday',
+      },
+    });
+  });
+
+  it('removes dangerous object keys', () => {
+    const input = {
+      safe: 'ok',
+      __proto__: { polluted: true },
+      constructor: 'bad',
+      prototype: 'bad',
+    };
+
+    expect(sanitizeValue(input)).toEqual({ safe: 'ok' });
+  });
+
+  it('drops branches that exceed max depth', () => {
+    const input = { level1: { level2: { level3: { keep: 'nope' } } } };
+    expect(sanitizeValue(input, { maxDepth: 2 })).toEqual({ level1: { level2: {} } });
+  });
+});
diff --git a/tests/integration/errorHandling.test.js b/tests/integration/errorHandling.test.js
index 0471c20..637a1e4 100644
--- a/tests/integration/errorHandling.test.js
+++ b/tests/integration/errorHandling.test.js
@@ -51,12 +51,13 @@ describe('API Integration Tests (RFC 7807)', () => {
     expect(response.body.data.invoiceId).toBe('test-invoice');
   });
 
-  test('GET /unknown-route should return 404 Not Found in RFC 7807 format', async () => {
+  test('GET /unknown-route should return 404 standardized error', async () => {
     const response = await request(app).get('/unknown-route');
 
     expect(response.status).toBe(404);
-    expect(response.body.type).toBe('https://liquifact.com/probs/not-found');
-    expect(response.body.title).toBe('Resource Not Found');
+    expect(response.headers['content-type']).toContain('application/problem+json');
+    expect(response.body.error).toBeDefined();
+    expect(response.body.error.code).toBe('NOT_FOUND');
   });
 
   test('GET /error-test-trigger should return 500 Internal Server Error', async () => {
diff --git a/tests/unit/errorHandler.test.js b/tests/unit/errorHandler.test.js
index d5b6480..a812830 100644
--- a/tests/unit/errorHandler.test.js
+++ b/tests/unit/errorHandler.test.js
@@ -24,7 +24,7 @@ describe('errorHandler Middleware Unit Tests', () => {
     console.error.mockRestore();
   });
 
-  test('should handle AppError and send RFC 7807 response', () => {
+  test('should handle AppError and send standardized envelope', () => {
     const error = new AppError({
       type: 'https://liquifact.com/probs/bad-request',
       title: 'Bad Request',
@@ -38,11 +38,13 @@ describe('errorHandler Middleware Unit Tests', () => {
     expect(mockResponse.status).toHaveBeenCalledWith(400);
     expect(mockResponse.json).toHaveBeenCalledWith(
       expect.objectContaining({
-        type: 'https://liquifact.com/probs/bad-request',
-        title: 'Bad Request',
-        status: 400,
-        detail: 'Invalid data',
-        instance: '/api/v1/test',
+        data: null,
+        meta: expect.any(Object),
+        error: expect.objectContaining({
+          message: 'Invalid data',
+          code: 'BAD_REQUEST',
+          details: null,
+        }),
       })
     );
   });
@@ -55,9 +57,12 @@ describe('errorHandler Middleware Unit Tests', () => {
     expect(mockResponse.status).toHaveBeenCalledWith(500);
     expect(mockResponse.json).toHaveBeenCalledWith(
       expect.objectContaining({
-        status: 500,
-        title: 'Internal Server Error',
-        detail: 'An unexpected error occurred while processing your request.',
+        data: null,
+        meta: expect.any(Object),
+        error: expect.objectContaining({
+          message: 'Something exploded',
+          code: 'INTERNAL_ERROR',
+        }),
       })
     );
   });
@@ -110,4 +115,4 @@ describe('errorHandler middleware', () => {
 
     process.env.NODE_ENV = 'test'; // reset
   });
-});
\ No newline at end of file
+});