Boss Asked If Our API Is Secure? The Dishwasher Silence

2026-10-28

It is 8:40 on a Monday. You are in the office kitchen, holding a mug that is not yet clean, waiting for the kettle.

Your boss comes in with a stack of plates from the dishwasher. She is not frowning. She asks the way people ask about the weather.

"Quick one. A customer wants to know if our API is secure. Can I tell them yes?"

The kettle clicks off. Somewhere behind you a printer warms up.

You open your mouth. What comes out is: "I think so. We've done the basics."

She nods, kindly. "Great. Can you put that in an email by Wednesday?"

She leaves with the plates. You stand there with a hot mug and a cold feeling in your stomach.

The word "basics"

You know what you meant by it. Passwords are hashed. There is a login. Somebody once added rate limiting, or at least you remember a ticket about it.

But "basics" is not an answer. It is a feeling dressed up as a sentence.

Back at your desk, the API looks the same as it did on Friday. Same routes, same green tests. Yet every endpoint now seems to be asking you a question you can't answer. Is this one checked for the right user? What does that one return when the token is wrong? Did anyone ever look at the admin routes after the refactor?

You are not careless. You built something that works, and that is real work. But "works" and "I can say it's been reviewed" are two different sentences, and your boss just asked for the second one.

What the doubt costs

Nobody sees this part. You scroll through route files between other tasks, hoping one of them will jump out. You open three browser tabs of security advice, each longer than the last, and close them again. A lot of it assumes you have a security team. You have a Monday and a Wednesday deadline.

You start drafting the email. We follow industry best practices. You delete it, because you can't point at the practices. No known issues. You delete that too, because "known" is doing a lot of quiet work in that sentence.

At lunch you eat at your desk. In the afternoon a colleague asks if you're okay, and you say you're fine. It's only that every time the customer's name appears in your head, you feel a little less like a professional and a little more like someone who got lucky so far.

Nothing is on fire. That is what makes it hard to talk about. There is just a low hum of what if I'm wrong, and it follows you home, into the supermarket queue, and into the shower.

The small turn

On Tuesday morning you catch yourself doing the same thing again: staring at a route file, hoping for inspiration. And a plainer thought arrives.

You don't need to be a security genius by Wednesday. You need a list. A sensible, finite list that someone who knows this area has already thought through. Something you can walk along, route by route, ticking things off and writing down what you find, so that your answer is no longer a feeling.

The doubt was never really about the code. It was about having no way to look at it.

When you see it that way, the task shrinks. It stops being "prove the whole API is safe", which nobody can ever promise. It becomes "go through a known set of checks, note what holds up, fix what doesn't, and be able to say exactly what was looked at."

That is something you can say to a customer without crossing your fingers.

The next Monday

Picture it a week later. The kitchen, the kettle, 8:40 again.

Your boss comes in with the same plates. "Did that customer thing get sorted?"

And you say: "Yes. We went through the API against a checklist. A few things needed fixing, and those are done. Here's the short report."

She doesn't ask what a rate limit is. She doesn't need to. She hears that it was looked at, by someone, in an orderly way, and that there is a page she can forward.

You are not claiming the API can never have a problem. No honest person does. You are saying what was checked, what was found, and what changed. It is a calmer sentence, and it is also a more professional one.

The mug is clean this time. The hum in your head is quiet. You notice you're drinking your coffee while it is still warm.

If you recognise the dishwasher moment

If someone has asked you "is it secure?" and your honest answer was "I think so," you are in good company. Most people who build APIs are not security specialists, and nobody hands them a map.

That is the gap we made the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for. It is a 58-item review kit with a PDF checklist and an XLSX tracker, curl tests, an auth-route scanner script, and a client report template, for Node/Express and Python. It won't make decisions for you or replace a proper security audit where you need one. It gives you a structured way to look, and something written down to show for it.

There is a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

You can take a look here: Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit

An illustrative story, written with AI assistance.