Help Securing Web App from Hack

I have a web application which runs my custom Twilio phone application. I now have had my Twilio account suspended twice, currently in the second suspension due to a suspicious IP usage from the Middle East, same country both times so its probably the same hacker. It is not me or my developer so its true that access shouldn't be granted. First time the hacker didn't do anything malicious, just requested a random message of mine. Second time, unsure as twilio hasn't gotten back to me on what the activity was. First time we rotated the keys and my developer couldn't find any issues with the app but he isn't a security expert. Need someone who can find the vulnerability in my app so that foreign IP access doesn't happen again. Currently on a hostinger server.