Worried About API Mass Assignment? The Badge Desk Pen

2026-11-02

Mara stands at the registration desk of a small regional dev conference. It is 8:40 on a Thursday and her lanyard is still in the box. The volunteer in front of her is handing out badges. Each badge has a name, a company and a coloured stripe: green for attendee, blue for speaker, black for organiser.

A man ahead of her is filling in a paper form. At the bottom is a line that says Ticket type. It was meant for the volunteers. He looks at it, shrugs, and writes Organiser. The volunteer glances up, says nothing, and prints a black stripe.

Nobody is angry. Nobody even notices. The form simply asked, so he answered.

Mara laughs, then stops. Her stomach does something small and cold.

The line on your own form

Yesterday she shipped a profile update endpoint for a client. It's a small thing. A user changes their display name and their phone number. The code takes whatever arrives in the request and saves it to the user record.

Whatever arrives.

She stands there holding a paper cup of conference coffee, running the user record through her head. Name. Email. Phone. Role. Plan. Verified. Credits.

The app's own screen only ever sends two of those fields. But nobody is forcing a browser to send only two fields. Anyone who looks at the request can add a line of their own, the way the man added Organiser.

She isn't sure it works that way in her code. That is the whole problem. She isn't sure.

What the worry costs

The keynote starts. Mara hears none of it.

She opens her laptop under the table and scrolls through the handler. She thinks it's probably fine. Then she scrolls to the model and thinks it's probably not fine. Then she remembers the client demo on Monday, where their product owner likes to click around "just to see what happens."

There is a particular kind of tiredness that comes from a doubt you can't size. It isn't a bug. A bug you could fix. It's a maybe, and a maybe follows you to lunch, to the train home and into the shower on Saturday.

She starts a message to the client: Quick question about the profile endpoint. She deletes it. She doesn't want to write I'm not sure my own code is safe to someone who pays her to be sure.

She starts a different message to herself instead, a list of everything she might have missed. It gets long. It gets vague. Auth stuff? Roles? Check other endpoints too? It reads like a to-do list written by someone holding their breath.

The turn

At the coffee break she watches the badge desk again. A different volunteer has taken over. She doesn't do anything clever. She just has a card in front of her that says which fields come from the attendee and which ones are hers alone.

Name: theirs. Company: theirs. Stripe: hers.

Nothing else about the desk changed. The pen was still on the table. Someone who wanted to could still write Organiser. But the desk no longer took the stripe from the form. It decided the stripe itself.

Mara puts down her cup.

The doubt hadn't come from the code being impossible. It had come from the review being formless. She was trying to hold the whole question in her head, with a client waiting and a keynote droning on. Nobody can hold "is my API okay?" in their head.

But you can hold a list. A short question per door, asked in the same order every time. Which fields can this request touch? Which ones should it never touch? Where do I check? A calm, boring list that someone else already thought through, so she doesn't have to invent it at 8:40 on a Thursday.

The after

Picture the Monday demo with that list behind you.

The product owner is clicking around, as usual. Mara is not watching his cursor. She's drinking her tea, which is still warm. She has a tracker with every route in it and a note beside each one: checked, here's how. If a question comes up, she doesn't say "I'll get back to you." She says "yes, I've looked at that," and means it.

There's also a short report she can send. It doesn't say "trust me." It says what was reviewed and what was found. It reads like the work of a professional, because it is.

The knot loosens. Not because the world became risk-free, since no checklist promises that, but because the maybe now has edges. You know what you looked at. You know what's left. You can close the laptop and actually hear the keynote.

If you recognise the pen

If you've ever shipped an endpoint and then wondered whether a user could slip in a field you never meant to offer, you know this feeling. It doesn't mean you're a careless developer. It means nobody gave you a clear way to look.

We built the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for exactly that moment. It has 58 items in a PDF, an XLSX tracker, curl tests, an auth-route scanner script for Node/Express and Python, and a client report template. It's a review kit, not a guarantee, and it doesn't replace a professional security audit when one is warranted.

If it doesn't help, there's a 30-day money-back promise: full refund, no questions.

See the REST API Security Checklist Kit

An illustrative story, written with AI assistance.