diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index 4c1903bd..1bc86af6 100755
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -22,6 +22,7 @@ $routes->get('/swagger', 'SwaggerController::index', ['filter' => 'authMVC']);
 $routes->get('/fedeploy', 'DeployController::fedeploy_view', ['filter' => 'authMVC']);
 $routes->post('/fedeploy', 'DeployController::fedeploy', ['filter' => 'authMVC']);
 $routes->get('/visitOffBoardCheck', 'EmployeeController::visitOffBoardCheck');
+$routes->get('/metaDashboardDemo', 'TestingController::metaDashboardDemo');
 
 // Reminder Mail Notification
 
diff --git a/app/Controllers/MasterController.php b/app/Controllers/MasterController.php
index dc6538d4..7017dd07 100755
--- a/app/Controllers/MasterController.php
+++ b/app/Controllers/MasterController.php
@@ -497,6 +497,9 @@ class MasterController extends AdminController
     {
 
         $this->myLogger->logme('error','Edit Insurer general info function called');
+        $postData = $this->request->getPost();
+        $logoFile = $this->request->getFile('insurer_logo');
+        
         $rules = [
             'name' => [
                 'rules'  => 'required',
@@ -513,22 +516,30 @@ class MasterController extends AdminController
                 ]
             ],
             'insurer_logo' => [
-                'rules' => 'if_exist|is_image[insurer_logo]|max_size[insurer_logo,200]|ext_in[insurer_logo,jpg,jpeg,png]',
+                'rules' => 'permit_empty|is_image[insurer_logo]|max_size[insurer_logo,200]|ext_in[insurer_logo,jpg,jpeg,png]',
                 'errors' => [
                     'is_image' => 'The uploaded file must be an image',
                     'max_size' => 'File size should not exceed 200 KB',
-                    'ext_in'   => 'Allowed file types: jpg, jpeg, png',
+                    'ext_in'   => 'Only JPG, JPEG, and PNG files are allowed.',
                 ]
             ],
         ];
 
-        if (!$this->validate($rules)) {
-            return $this->response->setStatusCode(400)->setJSON([
-                'status' => false,
-                'message' => 'Input validation failed',
-                'code' => 400,
-                'errors' => $this->validator->getErrors()
-            ]);
+        if (!$this->validateData($postData, $rules)) {
+                $errors = $this->validator->getErrors();
+        
+                $mainMessage = 'Input validation failed';
+    
+                if (isset($errors['insurer_logo']) && (strpos($errors['insurer_logo'], 'Security') !== false || strpos($errors['insurer_logo'], 'Forbidden') !== false)) {
+                    $mainMessage = 'File upload rejected: Security policy violation.';
+                }
+
+                return $this->response->setStatusCode(400)->setJSON([
+                    'status'  => false,
+                    'message' => $mainMessage, // This will change based on the error
+                    'code'    => 400,
+                    'errors'  => $this->validator->getErrors()
+                ]);
         }
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
diff --git a/app/Controllers/TestingController.php b/app/Controllers/TestingController.php
index 75d4d578..f6769af2 100644
--- a/app/Controllers/TestingController.php
+++ b/app/Controllers/TestingController.php
@@ -17,6 +17,8 @@ use PhpOffice\PhpSpreadsheet\Style\Alignment;
 use PhpOffice\PhpSpreadsheet\Style\Fill;
 use PhpOffice\PhpSpreadsheet\Style\Border;
 
+use Firebase\JWT\JWT;
+
 class TestingController extends BaseController
 {
     use ResponseTrait;
@@ -983,5 +985,44 @@ class TestingController extends BaseController
     }
 
 
+    public function metaDashboardDemo()
+    {
+
+        // 🔐 Move this to .env in real projects
+        $METABASE_SECRET_KEY = '6a9ec3d833576923ea04078188fe26cad17b5de351ab3ce349dd2c2d07b5d0cd';
+
+        $payload = [
+            'resource' => [
+                'dashboard' => 1
+            ],
+            'params' => (object)[],   // MUST be object for Metabase
+            'exp'    => time() + (10 * 60) // 10 minutes
+        ];
+
+        $token = JWT::encode($payload, $METABASE_SECRET_KEY, 'HS256');
+
+        // // You can either return token only
+        // return $this->response->setJSON([
+        //     'token' => $token,
+        //     'iframe_url' => "https://your-metabase-domain/embed/dashboard/{$token}#bordered=true&titled=true"
+        // ]);
+        if($this->request->getGet('api') == 1)
+        {
+             return $this->respond([
+                'status' => 'success',
+                'message' => 'Form data received successfully!',
+                'data' => [
+                'metabaseToken' => $token,
+                'metabaseUrl'   => 'https://nsights.nhanceindia.in']
+            ]);
+        }
+
+       return view('meta_dashboard_demo_one', [
+            'metabaseToken' => $token,
+            'metabaseUrl'   => 'https://nsights.nhanceindia.in',
+        ]);
+    }
+
+
 
 }
diff --git a/app/Views/insurer_basic_info.php b/app/Views/insurer_basic_info.php
index aadc43d3..f553b093 100755
--- a/app/Views/insurer_basic_info.php
+++ b/app/Views/insurer_basic_info.php
@@ -70,7 +70,7 @@ input:checked + .slider:before {
             <div class="card-body">
             <div class="custom-form">
             <form role="form" class="parsley-examples" method="post" id="insurer_general_form" enctype="multipart/form-data">
-                <input type="hidden" value="<?= csrf_hash() ?>" name="<?= csrf_token() ?>" />
+                <input type="hidden" value="<?= csrf_hash() ?>" name="<?= csrf_token() ?>" /> 
                 <input type="hidden" name="PrimaryKey" id="insurer_General_PrimaryKey" value="<?= isset($insurer['id']) ? $insurer['id'] : '' ?>" />
                 <input type="hidden" name="insurer_id" id="insurer_id" />
 
@@ -191,18 +191,29 @@ input:checked + .slider:before {
 <script>
     $(document).ready(function() {
 
+        $('#insurer_logo').on('change', function() {
+            PreviewImage(); 
+        });
+
         $("#insurer_general_form").submit(function(events) {
 
             events.preventDefault();
-
-            var isValid = $('#insurer_General_PrimaryKey').parsley().validate();  
+            
+            // var isValid = $('#insurer_General_PrimaryKey').parsley().validate();  
+            var isValid = $('#insurer_general_form').parsley().validate(); 
+            var PrimaryKey = $('#insurer_General_PrimaryKey').val();
             if (!isValid) { 
                 console.log('Form is Empty', 'Warning');
                 return ; 
             }
 
-            var PrimaryKey = $('#insurer_General_PrimaryKey').val();
-            var form_action = '';
+            var formElement = $('#insurer_general_form')[0];
+            var formData = new FormData(formElement);
+
+            // DEBUG: Log formData to see if it's empty
+            for (var pair of formData.entries()) {
+                console.log(pair[0]+ ', ' + pair[1]); 
+            }
             if (isValid) {
 
                 if (PrimaryKey === '') {
@@ -300,16 +311,46 @@ input:checked + .slider:before {
 
     });
 
-    function PreviewImage() 
-    {
+    function PreviewImage() {
+        var fileInput = document.getElementById("insurer_logo");
+        var preview = document.getElementById("uploadPreview");
+        var defaultAvatar = '<?= base_url() . "public/assets/images/avatar_2x.png" ?>';
+
+        // If no file is selected (or cleared by validation), reset preview and stop
+        if (!fileInput.files || !fileInput.files[0]) {
+            preview.src = defaultAvatar;
+            return;
+        }
+
+        var file = fileInput.files[0];
+        var fileName = file.name.toLowerCase();
+        var parts = fileName.split('.');
+        
+        // VALIDATION: Extensions and Double Extensions (e.g. .php.jpeg)
+        var allowedExtensions = /(\.jpg|\.jpeg|\.png)$/i;
+
+        if (!allowedExtensions.exec(fileName) || parts.length > 2) {
+            toastr.error("Security violation: Invalid format or double extension.", "Blocked");
+            fileInput.value = ""; // Clear the field
+            preview.src = defaultAvatar; // RESET PREVIEW
+            return;
+        }
+
+        // VALIDATION: Size (200KB)
+        if ((file.size / 1024) > 200) {
+            toastr.warning("File size exceeds 200 KB limit.", "Warning");
+            fileInput.value = ""; // Clear the field
+            preview.src = defaultAvatar; // RESET PREVIEW
+            return;
+        }
+
+        // SUCCESS: Read and Preview
         var oFReader = new FileReader();
-        oFReader.readAsDataURL(document.getElementById("insurer_logo").files[0]);
-
+        oFReader.readAsDataURL(file);
         oFReader.onload = function(oFREvent) {
-            document.getElementById("uploadPreview").src = oFREvent.target.result;
+            preview.src = oFREvent.target.result;
         };
-    };
-
+    }
     //-----------------------------------------------------------------------------------------------------
 
 
diff --git a/app/Views/meta_dashboard_demo_one.php b/app/Views/meta_dashboard_demo_one.php
new file mode 100644
index 00000000..4652f9e9
--- /dev/null
+++ b/app/Views/meta_dashboard_demo_one.php
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Metabase Dashboard</title>
+
+    <!-- Metabase embed script -->
+    <script defer src="<?= esc($metabaseUrl) ?>/app/embed.js"></script>
+
+    <script>
+        function defineMetabaseConfig(config) {
+            window.metabaseConfig = config;
+        }
+
+        defineMetabaseConfig({
+            theme: {
+                preset: "light"
+            },
+            isGuest: true,
+            instanceUrl: "<?= esc($metabaseUrl) ?>"
+        });
+    </script>
+</head>
+<body>
+
+    <metabase-dashboard
+        token="<?= esc($metabaseToken) ?>"
+        with-title="true"
+        with-downloads="true">
+    </metabase-dashboard>
+
+</body>
+</html>