diff --git a/src/workers/__tests__/sms-cluster-worker.test.ts b/src/workers/__tests__/sms-cluster-worker.test.ts
index 8a1adc96..a4340225 100644
--- a/src/workers/__tests__/sms-cluster-worker.test.ts
+++ b/src/workers/__tests__/sms-cluster-worker.test.ts
@@ -1,5 +1,11 @@
 import cluster from 'cluster';
-import { startSMSClusterWorker } from '../sms-cluster-worker';
+import { 
+  startSMSClusterWorker, 
+  sanitizeAndValidateSMS, 
+  getSecurityEvents,
+  getQueueSize,
+  getRateLimitStatus 
+} from '../sms-cluster-worker';
 
 jest.mock('cluster', () => ({
   isPrimary: true,
@@ -14,41 +20,172 @@ jest.mock('os', () => ({
 describe('SMS Cluster Worker', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    // Clear security events before each test
+    const events = getSecurityEvents();
+    events.length = 0;
   });
 
-  it('should fork a worker for each CPU if primary', () => {
-    // Override cluster.isPrimary just in case
-    Object.defineProperty(cluster, 'isPrimary', { value: true, configurable: true });
+  describe('Cluster Management', () => {
+    it('should fork a worker for each CPU if primary', () => {
+      Object.defineProperty(cluster, 'isPrimary', { value: true, configurable: true });
 
-    const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+      const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
 
-    startSMSClusterWorker();
+      startSMSClusterWorker();
 
-    expect(cluster.fork).toHaveBeenCalledTimes(4);
-    expect(consoleSpy).toHaveBeenCalledWith(
-      expect.stringContaining('Setting up cluster with 4 workers'),
-    );
+      expect(cluster.fork).toHaveBeenCalledTimes(4);
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Setting up cluster with 4 workers'),
+      );
 
-    consoleSpy.mockRestore();
+      consoleSpy.mockRestore();
+    });
+
+    it('should bind an exit handler to auto-heal workers', () => {
+      Object.defineProperty(cluster, 'isPrimary', { value: true, configurable: true });
+
+      startSMSClusterWorker();
+
+      expect(cluster.on).toHaveBeenCalledWith('exit', expect.any(Function));
+    });
+
+    it('should execute worker logic if not primary', () => {
+      Object.defineProperty(cluster, 'isPrimary', { value: false, configurable: true });
+      const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+
+      startSMSClusterWorker();
+
+      expect(cluster.fork).not.toHaveBeenCalled();
+      expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Worker'));
+
+      consoleSpy.mockRestore();
+    });
+
+    it('should set worker resource limits', () => {
+      Object.defineProperty(cluster, 'isPrimary', { value: true, configurable: true });
+
+      startSMSClusterWorker();
+
+      expect(cluster.fork).toHaveBeenCalledWith(
+        expect.objectContaining({
+          WORKER_ID: expect.any(Number),
+          NODE_OPTIONS: expect.stringContaining('--max-old-space-size=512'),
+        })
+      );
+    });
   });
 
-  it('should bind an exit handler to auto-heal workers', () => {
-    Object.defineProperty(cluster, 'isPrimary', { value: true, configurable: true });
+  describe('Input Validation', () => {
+    it('should validate correct phone numbers', () => {
+      const result = sanitizeAndValidateSMS('+15551234567', 'Test message');
+      expect(result.valid).toBe(true);
+      expect(result.sanitized).toBeDefined();
+    });
+
+    it('should reject invalid phone number format', () => {
+      const result = sanitizeAndValidateSMS('5551234567', 'Test message');
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('Invalid phone number format');
+    });
 
-    startSMSClusterWorker();
+    it('should reject phone numbers that are too long', () => {
+      const result = sanitizeAndValidateSMS('+155512345678901234567', 'Test message');
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('too long');
+    });
 
-    expect(cluster.on).toHaveBeenCalledWith('exit', expect.any(Function));
+    it('should reject non-string phone numbers', () => {
+      const result = sanitizeAndValidateSMS(1234567890 as any, 'Test message');
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('must be a string');
+    });
+
+    it('should reject empty messages', () => {
+      const result = sanitizeAndValidateSMS('+15551234567', '');
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('cannot be empty');
+    });
+
+    it('should reject messages that are too long', () => {
+      const longMessage = 'a'.repeat(2000);
+      const result = sanitizeAndValidateSMS('+15551234567', longMessage);
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('too long');
+    });
+
+    it('should sanitize message content', () => {
+      const result = sanitizeAndValidateSMS('+15551234567', '<script>alert("xss")</script>');
+      expect(result.valid).toBe(true);
+      expect(result.sanitized?.message).not.toContain('<script>');
+    });
+  });
+
+  describe('Rate Limiting', () => {
+    it('should allow messages within rate limit', () => {
+      for (let i = 0; i < 50; i++) {
+        const result = sanitizeAndValidateSMS('+15551234567', `Test message ${i}`);
+        expect(result.valid).toBe(true);
+      }
+    });
+
+    it('should enforce rate limit after threshold', () => {
+      // Send 100 messages (should hit the limit)
+      for (let i = 0; i < 100; i++) {
+        sanitizeAndValidateSMS('+15551234567', `Test message ${i}`);
+      }
+
+      // 101st message should be rate limited
+      const result = sanitizeAndValidateSMS('+15551234567', 'Test message 100');
+      expect(result.valid).toBe(false);
+      expect(result.reason).toContain('Rate limit exceeded');
+    });
+
+    it('should track rate limit status correctly', () => {
+      for (let i = 0; i < 50; i++) {
+        sanitizeAndValidateSMS('+15551234567', `Test message ${i}`);
+      }
+
+      const status = getRateLimitStatus('+15551234567');
+      expect(status.remaining).toBeLessThanOrEqual(50);
+      expect(status.resetTime).toBeGreaterThan(Date.now());
+    });
   });
 
-  it('should execute worker logic if not primary', () => {
-    Object.defineProperty(cluster, 'isPrimary', { value: false, configurable: true });
-    const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+  describe('Security Event Logging', () => {
+    it('should log validation failures', () => {
+      sanitizeAndValidateSMS('invalid', 'Test message');
+      const events = getSecurityEvents();
+      
+      expect(events.length).toBeGreaterThan(0);
+      expect(events[events.length - 1].type).toBe('validation_failure');
+    });
 
-    startSMSClusterWorker();
+    it('should log rate limit exceeded events', () => {
+      for (let i = 0; i < 101; i++) {
+        sanitizeAndValidateSMS('+15551234567', `Test message ${i}`);
+      }
+      
+      const events = getSecurityEvents();
+      const rateLimitEvents = events.filter(e => e.type === 'rate_limit_exceeded');
+      expect(rateLimitEvents.length).toBeGreaterThan(0);
+    });
 
-    expect(cluster.fork).not.toHaveBeenCalled();
-    expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Worker'));
+    it('should limit security event history size', () => {
+      // Generate more than 1000 events
+      for (let i = 0; i < 1100; i++) {
+        sanitizeAndValidateSMS(`+155512345${i % 100}`, `Test message ${i}`);
+      }
+      
+      const events = getSecurityEvents();
+      expect(events.length).toBeLessThanOrEqual(1000);
+    });
+  });
 
-    consoleSpy.mockRestore();
+  describe('Queue Management', () => {
+    it('should return current queue size', () => {
+      const size = getQueueSize();
+      expect(typeof size).toBe('number');
+      expect(size).toBeGreaterThanOrEqual(0);
+    });
   });
 });
diff --git a/src/workers/sms-cluster-worker.ts b/src/workers/sms-cluster-worker.ts
index c6c789dc..b3534d59 100644
--- a/src/workers/sms-cluster-worker.ts
+++ b/src/workers/sms-cluster-worker.ts
@@ -1,15 +1,60 @@
 import cluster from 'cluster';
 import os from 'os';
 import { sendSMS } from '../utils/notificationUtils'; // Assuming we have this or we'll mock it
+import { sanitizeString } from '../lib/security';
 
 const numCPUs = os.cpus().length;
 
-// Mock Queue implementation
+// Security Configuration
+const SECURITY_CONFIG = {
+  MAX_QUEUE_SIZE: 1000,
+  MAX_MESSAGE_LENGTH: 1600,
+  MAX_PHONE_NUMBER_LENGTH: 20,
+  RATE_LIMIT_WINDOW_MS: 60000, // 1 minute
+  RATE_LIMIT_MAX_PER_WINDOW: 100,
+  WORKER_MAX_MEMORY_MB: 512,
+  WORKER_TIMEOUT_MS: 30000,
+};
+
+// Phone number validation regex (E.164 format)
+const PHONE_NUMBER_REGEX = /^\+[1-9]\d{1,14}$/;
+
+// Rate limiting tracker
+const rateLimitTracker = new Map<string, number[]>();
+
+// Security event logger
+interface SecurityEvent {
+  type: 'validation_failure' | 'rate_limit_exceeded' | 'queue_full' | 'worker_timeout';
+  timestamp: number;
+  details: string;
+  workerId?: number;
+}
+
+const securityEvents: SecurityEvent[] = [];
+
+function logSecurityEvent(event: SecurityEvent) {
+  securityEvents.push(event);
+  console.error(`[SECURITY] ${event.type}: ${event.details}`);
+  if (securityEvents.length > 1000) {
+    securityEvents.shift(); // Keep only last 1000 events
+  }
+}
+
+// Mock Queue implementation with security controls
 class SMSQueue {
-  private messages: { to: string; message: string }[] = [];
+  private messages: { to: string; message: string; timestamp: number }[] = [];
 
-  enqueue(to: string, message: string) {
-    this.messages.push({ to, message });
+  enqueue(to: string, message: string): boolean {
+    if (this.messages.length >= SECURITY_CONFIG.MAX_QUEUE_SIZE) {
+      logSecurityEvent({
+        type: 'queue_full',
+        timestamp: Date.now(),
+        details: `Queue rejected message. Current size: ${this.messages.length}`,
+      });
+      return false;
+    }
+    this.messages.push({ to, message, timestamp: Date.now() });
+    return true;
   }
 
   dequeue() {
@@ -23,43 +68,175 @@ class SMSQueue {
 
 const smsQueue = new SMSQueue();
 
-// Seed queue for demonstration
+// Input validation and sanitization
+function validatePhoneNumber(phone: string): { valid: boolean; reason?: string } {
+  if (typeof phone !== 'string') {
+    return { valid: false, reason: 'Phone number must be a string' };
+  }
+  if (phone.length > SECURITY_CONFIG.MAX_PHONE_NUMBER_LENGTH) {
+    return { valid: false, reason: 'Phone number too long' };
+  }
+  if (!PHONE_NUMBER_REGEX.test(phone)) {
+    return { valid: false, reason: 'Invalid phone number format (must be E.164)' };
+  }
+  return { valid: true };
+}
+
+function validateMessage(message: string): { valid: boolean; reason?: string } {
+  if (typeof message !== 'string') {
+    return { valid: false, reason: 'Message must be a string' };
+  }
+  if (message.length > SECURITY_CONFIG.MAX_MESSAGE_LENGTH) {
+    return { valid: false, reason: 'Message too long' };
+  }
+  if (message.trim().length === 0) {
+    return { valid: false, reason: 'Message cannot be empty' };
+  }
+  return { valid: true };
+}
+
+function checkRateLimit(phoneNumber: string): boolean {
+  const now = Date.now();
+  const timestamps = rateLimitTracker.get(phoneNumber) || [];
+  
+  // Remove timestamps outside the rate limit window
+  const validTimestamps = timestamps.filter(t => now - t < SECURITY_CONFIG.RATE_LIMIT_WINDOW_MS);
+  
+  if (validTimestamps.length >= SECURITY_CONFIG.RATE_LIMIT_MAX_PER_WINDOW) {
+    logSecurityEvent({
+      type: 'rate_limit_exceeded',
+      timestamp: now,
+      details: `Rate limit exceeded for ${phoneNumber}: ${validTimestamps.length} requests in window`,
+    });
+    return false;
+  }
+  
+  validTimestamps.push(now);
+  rateLimitTracker.set(phoneNumber, validTimestamps);
+  return true;
+}
+
+function sanitizeAndValidateSMS(to: string, message: string): { valid: boolean; sanitized?: { to: string; message: string }; reason?: string } {
+  const phoneValidation = validatePhoneNumber(to);
+  if (!phoneValidation.valid) {
+    logSecurityEvent({
+      type: 'validation_failure',
+      timestamp: Date.now(),
+      details: `Phone validation failed: ${phoneValidation.reason}`,
+    });
+    return { valid: false, reason: phoneValidation.reason };
+  }
+
+  const messageValidation = validateMessage(message);
+  if (!messageValidation.valid) {
+    logSecurityEvent({
+      type: 'validation_failure',
+      timestamp: Date.now(),
+      details: `Message validation failed: ${messageValidation.reason}`,
+    });
+    return { valid: false, reason: messageValidation.reason };
+  }
+
+  if (!checkRateLimit(to)) {
+    return { valid: false, reason: 'Rate limit exceeded' };
+  }
+
+  // Sanitize message content
+  const sanitizedMessage = sanitizeString(message);
+
+  return {
+    valid: true,
+    sanitized: { to, message: sanitizedMessage },
+  };
+}
+
+// Seed queue for demonstration (with validation)
 for (let i = 0; i < 50; i++) {
-  smsQueue.enqueue(`+155512345${i.toString().padStart(2, '0')}`, `Test message ${i}`);
+  const phone = `+155512345${i.toString().padStart(2, '0')}`;
+  const message = `Test message ${i}`;
+  const validation = sanitizeAndValidateSMS(phone, message);
+  if (validation.valid) {
+    smsQueue.enqueue(validation.sanitized!.to, validation.sanitized!.message);
+  }
 }
 
 export const startSMSClusterWorker = () => {
   if (cluster.isPrimary) {
     console.log(`Primary ${process.pid} is running`);
     console.log(`Setting up cluster with ${numCPUs} workers for SMS processing...`);
+    console.log(`Security config: Max queue size=${SECURITY_CONFIG.MAX_QUEUE_SIZE}, Rate limit=${SECURITY_CONFIG.RATE_LIMIT_MAX_PER_WINDOW}/min`);
 
-    // Fork workers.
+    // Fork workers with resource limits
     for (let i = 0; i < numCPUs; i++) {
-      cluster.fork();
+      const worker = cluster.fork({
+        WORKER_ID: i,
+        NODE_OPTIONS: `--max-old-space-size=${SECURITY_CONFIG.WORKER_MAX_MEMORY_MB}`,
+      });
+
+      // Set worker timeout
+      setTimeout(() => {
+        if (worker.isConnected()) {
+          logSecurityEvent({
+            type: 'worker_timeout',
+            timestamp: Date.now(),
+            details: `Worker ${worker.process.pid} exceeded timeout, restarting`,
+            workerId: i,
+          });
+          worker.kill();
+        }
+      }, SECURITY_CONFIG.WORKER_TIMEOUT_MS);
     }
 
     cluster.on('exit', (worker, code, signal) => {
       console.log(`Worker ${worker.process.pid} died with code: ${code}, and signal: ${signal}`);
+      logSecurityEvent({
+        type: 'worker_timeout',
+        timestamp: Date.now(),
+        details: `Worker ${worker.process.pid} exited unexpectedly. Code: ${code}, Signal: ${signal}`,
+      });
       console.log('Starting a new worker...');
       cluster.fork(); // Auto-heal workers
     });
+
+    // Periodic security audit log
+    setInterval(() => {
+      console.log(`[SECURITY AUDIT] Queue size: ${smsQueue.length}, Active workers: ${Object.keys(cluster.workers || {}).length}`);
+      console.log(`[SECURITY AUDIT] Total security events: ${securityEvents.length}`);
+    }, 60000); // Every minute
   } else {
     // Workers can share any TCP connection
     // In this case it is an HTTP server or a message queue listener
-    console.log(`Worker ${process.pid} started for SMS processing`);
+    const workerId = process.env.WORKER_ID ? parseInt(process.env.WORKER_ID) : process.pid;
+    console.log(`Worker ${process.pid} (ID: ${workerId}) started for SMS processing`);
 
     const processQueue = async () => {
-      // Basic mock of polling a queue
       const messageJob = smsQueue.dequeue();
       if (messageJob) {
+        const startTime = Date.now();
         try {
           console.log(`[Worker ${process.pid}] Processing SMS for ${messageJob.to}...`);
+          
+          // Validate before processing (double-check)
+          const validation = sanitizeAndValidateSMS(messageJob.to, messageJob.message);
+          if (!validation.valid) {
+            console.error(`[Worker ${process.pid}] Validation failed: ${validation.reason}`);
+            return;
+          }
+
           // Note: In a real app we'd use sendSMS(messageJob.to, messageJob.message)
           // For now we just mock the delay
           await new Promise((resolve) => setTimeout(resolve, Math.random() * 500 + 100));
-          console.log(`[Worker ${process.pid}] Successfully sent SMS to ${messageJob.to}`);
+          
+          const processingTime = Date.now() - startTime;
+          console.log(`[Worker ${process.pid}] Successfully sent SMS to ${messageJob.to} in ${processingTime}ms`);
         } catch (error) {
           console.error(`[Worker ${process.pid}] Failed to send SMS:`, error);
+          logSecurityEvent({
+            type: 'validation_failure',
+            timestamp: Date.now(),
+            details: `SMS processing failed for ${messageJob.to}: ${error}`,
+            workerId,
+          });
         }
       }
 
@@ -71,6 +248,28 @@ export const startSMSClusterWorker = () => {
   }
 };
 
+// Export security functions for external use
+export { sanitizeAndValidateSMS, getSecurityEvents };
+
+export function getSecurityEvents(): SecurityEvent[] {
+  return [...securityEvents];
+}
+
+export function getQueueSize(): number {
+  return smsQueue.length;
+}
+
+export function getRateLimitStatus(phoneNumber: string): { remaining: number; resetTime: number } {
+  const now = Date.now();
+  const timestamps = rateLimitTracker.get(phoneNumber) || [];
+  const validTimestamps = timestamps.filter(t => now - t < SECURITY_CONFIG.RATE_LIMIT_WINDOW_MS);
+  const remaining = Math.max(0, SECURITY_CONFIG.RATE_LIMIT_MAX_PER_WINDOW - validTimestamps.length);
+  const oldestTimestamp = validTimestamps.length > 0 ? Math.min(...validTimestamps) : now;
+  const resetTime = oldestTimestamp + SECURITY_CONFIG.RATE_LIMIT_WINDOW_MS;
+  
+  return { remaining, resetTime };
+}
+
 // In a real entrypoint file, you'd call this:
 // if (require.main === module) {
 //   startSMSClusterWorker();