Customer Sent a Security Questionnaire? The Cake Counter
2026-10-27
It is 12:40 on a Thursday, and you are third in line at the bakery counter. You are collecting a cake for your sister's birthday.
Your phone buzzes. The subject line says: Vendor security assessment – please complete by Friday.
You open it with one thumb. There is a spreadsheet attached. Sixty-two rows. Column A holds the questions, and column C is labelled "Your response", which is empty.
You scroll. Describe your API authentication and authorisation model. How is rate limiting enforced? How do you handle broken object-level access? When was your last independent review?
The woman ahead of you orders six rolls. You read the same row three times.
The sentence you can't write
Let's call you Jonas. You are a freelance backend developer, and you built this API for a small logistics firm over eight months. It works. Their drivers use it every day, and nobody has complained.
But "it works" is not an answer to row 14.
You think the auth is fine. You remember choosing the token lifetime. You remember adding a check on one route and meaning to add it to the others. You cannot say with a straight face whether you did.
That is the quiet part nobody mentions. The customer is not accusing you of anything. They are just asking. But every blank cell feels like a small exam you didn't know you'd signed up for.
What it costs, before you've typed a word
"Seven rolls and the cake?" says the person behind the counter. You nod without hearing.
In your head the afternoon is already rearranged. The invoice you meant to write will wait. So will the thing you promised another client. You will open the spreadsheet tonight, and tomorrow, and probably over the weekend.
There is also the other cost. The thought arrives uninvited: what if they ask who reviewed it, and the answer is only me?
You think about writing "Yes, industry standard" in every cell and hoping nobody looks closer. You don't like that thought. You are not that kind of professional. But you are not sure you're the other kind either, the kind with a binder, a process and a calm voice for exactly this call.
So you pay for the cake and carry it to your car. You sit there with the engine off, the box warm on the passenger seat, and a spreadsheet that feels heavier than it should.
The turn
Here is what changes the afternoon, and it isn't a sudden burst of expertise.
It is the realisation that the questionnaire is not really testing what you know. It is asking whether you have looked, on purpose, in a structured way, and whether you can say so plainly.
Those are different things. Nobody can pull a full answer out of memory in a bakery queue. But a person who has a list, who has gone through it route by route and written down what held and what didn't, can answer in an hour what used to take a weekend.
You don't need to be a security department. You need to have a review you can point to, and a way to say "here is what I checked, here is what I fixed, here is what is still open." That sentence is calm, honest and professional, and it is available to a one-person shop.
A different Thursday
Imagine the same email, with the review already done.
The spreadsheet arrives. You read row 14 and you know where the answer lives. You open your tracker, see the item ticked, see the note about the route you fixed in the spring, and write two clear sentences.
Row 22 asks about rate limiting. You have a line for it. Row 31 asks when it was last reviewed, and you have a date.
Some rows will still say "not applicable" or "planned for next quarter." That is fine. An honest "planned" lands better with a careful customer than a vague "yes" ever could.
You finish before the cake is cut. You send the answers with a short, tidy summary attached, and the reply comes back the next morning: Thanks, this is clearer than most. Maybe it does. Maybe it is just "received." Either way, nothing in your chest tightened while you waited.
The weekend is yours. The cake is good.
What a normal week feels like after
This is the part worth wanting. It is not a perfect, unbreakable API, because nobody gets that. It is the feeling of knowing where you stand.
A new customer's questionnaire becomes a Tuesday task instead of a dread. A launch stops being a held breath. When someone asks "who checked this?", you can say "I did, systematically, and here is the record."
That is what turns "a developer who built an API" into "a business a customer can trust." It also costs far less sleep.
If you recognised yourself in the bakery queue
If a questionnaire like this is sitting in your inbox, or you know one is coming, there is a gentle next step.
The Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item API review kit for Node/Express and Python: a PDF, an XLSX tracker, curl tests, an auth-route scanner script and a client report template. It gives you something to work through and something to hand over, so the blank cells have a place to come from. It does not replace an independent security audit, and it makes no promises about your particular system. It is a structured way to look and to show that you looked.
It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.
And whatever you decide, go and eat the cake first.
An illustrative story, written with AI assistance.