Ex-Employee Still Has Your API Keys? The Returned Laptop

2026-11-03

The courier knocks at 9:10 on a Tuesday, just as you are pouring the first coffee.

A padded envelope. Inside, a grey laptop with a sticker of a cartoon fox on the lid, and a handwritten note: All wiped, good luck with everything! – Jonas.

You smile. Jonas was good. He built most of the shop's backend over two years, and he left on friendly terms. There was a card, a small gift, a hug at the door.

You set the laptop on the kitchen counter and look at it.

Then a quieter thought arrives, the one you didn't have during the goodbye.

What else did he take with him that doesn't fit in an envelope?

The question nobody asks at a farewell

You are not suspicious of Jonas. That is what makes it awkward. Nothing in you thinks he would do anything wrong.

But the thought doesn't care about trust. It just sits there, politely, next to the coffee.

He set up the payment connection. He set up the email service. There was some kind of key for the shipping provider, and another for the thing that sends the order confirmations. Where do those live? Who else has seen them? Did they ever get pasted into a chat to "just get it working"?

You realise you can't answer a single one of those questions. Not because anything is wrong. Because nobody ever wrote it down.

You open the laptop lid anyway, as if the answer might be on the screen. A blank login window looks back at you.

The list in your head

By ten o'clock you are at your desk with a half-written note. It has three lines:

• payment thing
• email thing
• ask someone?

You know what the note really says. It says: I run a real business, and I don't know where its doors are.

That feeling is not about Jonas at all. It is about the way small teams grow. One person says "I'll sort it," and for two years they do. Then they leave, and the sorting leaves with them. What remains is a shop that works and a nagging sense that you are standing on a floor you never inspected.

You think about who you could ask. The freelancer who helps on Fridays? She is lovely, but you'd feel strange handing her that much weight. Your cousin who "does IT"? He would say just change everything, and then you'd be in a different kind of panic.

And there is the quiet cost. You catch yourself checking the order dashboard more often than usual. At lunch you scroll the support inbox for anything odd. At the supermarket queue at six, the thought comes back, so you stand there holding a bag of oranges, running through doors you cannot name.

Nothing has gone wrong. That is the strangest part. You are tired from something that hasn't happened.

The turning point is smaller than you think

On Thursday you do something modest. You stop trying to solve it in your head and ask a different question.

Not am I in danger? but what would a careful person check, in what order, when someone leaves?

That question has a shape. A careful person doesn't panic and doesn't shrug. They go through a list. One thing at a time, each marked done or not done. A list that exists before the worry does, so the worry has somewhere to go.

You realise the problem was never that you lacked technical talent. You lacked a page.

A page that says: here is what we have, here is who can reach it, here is what we looked at and when. A page you can hand to the Friday freelancer, or to a customer who someday asks, Is your system safe?, or simply keep for yourself so your own head stops holding it all.

The relief isn't dramatic. It is the feeling of a window being opened in a stuffy room.

A normal Monday, afterwards

Picture it, a few weeks on.

It is Monday, 8:30. You make coffee. Somewhere in a folder there is a checklist with ticks next to the things that matter. Some items say done, a couple say later, and here's why. Nothing is a mystery any more.

When the next person joins, or leaves, you don't feel your stomach tighten. You open the page, and there is a calm, ordinary routine for it, a bit like locking up the shop at night.

The laptop goes back to being just a laptop. You wipe the fox sticker off the lid, and it goes to the Friday freelancer, who is delighted.

At six o'clock, in the supermarket queue, you think about dinner. Only dinner.

If you recognise yourself

This story is made up, but the feeling usually isn't. If someone has just left your team, or you've inherited an API you didn't build, and a small voice keeps asking what you've missed, you might like something to work through instead of carrying it in your head.

The Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item review kit: a PDF checklist, an XLSX tracker, curl tests, an auth-route scanner script and a client report template, for Node/Express and Python. It is made for exactly that moment: a clear page, and a record that you looked. It is an organising aid, not a replacement for a professional security review. If it doesn't help, there is a 30-day money-back promise, no questions.

You can look at it here: REST API Security Checklist Kit

An illustrative story, written with AI assistance.