Asked to Review API Security, Don't Know Where to Start?

2026-10-27

The piano tuner has been working on the same note for four minutes.

It is a Tuesday, just after ten. Mara sits at the kitchen table with her laptop open and a cold coffee beside it. From the next room comes one pitch, over and over, a little sharper, a little flatter, then nearly right.

She is not listening to it. She is reading one email for the sixth time.

"Hi Mara, could you review our API security before the pilot goes live on Friday week? Nothing huge, just a once-over. Our investor's IT person wants a short written summary. Thanks!"

Nothing huge. Mara has built backends for eight years, and she has just realised that nobody has ever asked her this. She builds APIs. She has never been the person who signs off that one is safe.

The reply you don't send

She types: "Happy to help, I'll get started."

She deletes it. The honest version would be: "I'm not sure where to begin, and I'm afraid of missing something." She deletes that too.

The cursor blinks. Behind it, her head is already running the wrong film. She is sitting in a call, someone asks "and you checked everything?", and she hears herself say "yes" without being sure it is true.

The piano gives up on one note and moves to the next.

What it costs before you've done anything

Nobody warns you that this kind of request costs you before you open a single file.

It costs you the morning, because you open six browser tabs of advice and close them again. Every article contradicts the last, and every list starts at a different place. It costs you the confidence you had at breakfast, when you were a person who knew things. It costs you a quiet kind of dignity: you are being paid as an expert, and you feel like someone bluffing.

And it costs you the sentence you were going to say at the end of the week, the one a client actually needs to hear. "I looked, here is what I found, here is what I'd fix first." Without a clear shape, you can't say it. You can only say "it seems fine," and "it seems fine" is the loneliest sentence in the trade.

Mara knows all this. She has felt it before with invoices and quotes: a task so vague it has no edges, so she circles it. She makes more coffee instead.

The question underneath

The tuner stops. In the sudden quiet she realises what has been bothering her, and it isn't a lack of skill.

It's that she has no edges for this. No list that says "this is the review, this is how far it goes, and when you've done it, you've done it." Without edges, every idea is a new fear. What about the token that never expires? What about the route she wrote on a Thursday and forgot? What if the thing she doesn't check is the thing that matters?

A person can only be calm about a job they can see the end of.

She thinks of the piano. The tuner isn't anxious. He doesn't wonder whether the whole instrument is wrong. He has an order he works in, and he knows what "done" sounds like. He is not cleverer than she is, he just has a way of going about it.

She closes five of the six tabs.

Starting with a shape

That afternoon she does something small. She stops trying to know everything and looks for one honest, structured way to ask the questions. A list she can work down, with a place to write what she found and a clear marker for what is checked and what is not.

The relief is physical. It isn't that the work vanishes. It's that the fog turns into a list, and a list is something you can start on a Tuesday.

By the end of the day she has written one thing in her own words in a document called Review notes: "Scope: what I will look at. What I won't." It is the first calm sentence she has written all week.

The Monday after

Picture the following Monday, the one before the pilot.

Mara is at the same table, the piano in the next room in tune now, ignored. She has an actual document open with a start and an end. Some lines say "checked, fine." A few say "found, fix this first." One says "not in scope, worth a conversation."

When the client's investor asks his IT person to read the summary, there is something to read. When someone asks "and you checked everything?", she doesn't have to bluff. She can say, "Here is exactly what I checked, and here is what I'd look at next."

That sentence is quieter than "it seems fine." It is also much easier to say.

She closes the laptop at six. The coffee is hot, because she drank it.

If you're the one with the email

Maybe you recognise Mara. Maybe you've just been asked to "have a look" at an API, and your stomach did something odd. You don't need to become a security researcher by Friday. You need edges, an order to work in, and something clear to hand over at the end.

That is why we made the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit. It is a 58-item review kit for Node/Express and Python: a PDF checklist, an XLSX tracker, curl tests, an auth-route scanner script and a client report template. It does not replace a professional security audit, and it makes no promises about your particular system. It gives you a calm place to start and a clear way to say what you did.

If it doesn't help, there is a 30-day money-back promise, no questions asked.

The next note is waiting. Start with the first line.

An illustrative story, written with AI assistance.