Inherited an API, Is It Secure? The Fuse Box Viewing

2026-10-29

It is Saturday, 10:40, and you are standing in a stranger's hallway.

You came to see a flat. The agent is talking about parquet floors. You are looking at the small grey door under the stairs, because you opened it a minute ago and found the fuse box. Nothing in it was labelled. Eleven switches, no names.

"The previous owner didn't leave much paperwork," the agent says, cheerfully. "But it's all been fine for years."

And your stomach does something you recognise. Not because of the flat. Because of Monday.

The thing you inherited in March

Let's call you Jonas. Three weeks ago a client's developer left. He was kind about it, even left a note. The note said: API is in the repo, deploy script is in the README, ask if anything breaks.

He can't be asked now. He started somewhere new and his old email bounces.

So the API is yours. It handles logins, customer records, a few payment-adjacent calls. It has been running for two years, and nobody has complained. That is the entire security report you have: nobody has complained.

You don't know who wrote which route. You don't know why one endpoint takes an ID in the URL and trusts it. You don't know whether the staging keys in the old config are still alive somewhere. You have a feeling about that one folder named old_ something. You have not opened it again since the first day.

What it quietly costs

Nobody is shouting. That is what makes it hard.

It costs a little every day. You open the project on Tuesday morning and close it again after reading only the parts you need. You add a feature on top of a floor you haven't tested. When the client says, lightly, "we're fine on security, right?", you hear yourself say, "As far as I can tell," and the words taste like cardboard.

It costs your Sunday lunch, too. You sit with people you love and half of you is in a folder, wondering what is behind the unlabelled switches.

And there is a smaller shame under it. A real professional would just know. A real professional would have a way of looking. You are good at your work. But being good at building is not the same as having a calm, repeatable way of checking what someone else built.

The agent's cheerful voice

Back in the hallway, the agent is still talking. You hear yourself ask, almost without meaning to, "Could we have the electrics inspected before any offer?"

"Oh, of course. Most people do."

Most people do.

You stand there with that sentence. Nobody here thinks it is strange or paranoid to say I'd like someone to go through this properly before I trust it. Nobody takes it as an insult to the previous owner. It is simply what you do with a thing you did not build and now live in.

You have never given your inherited code the same courtesy.

The turning point, on the pavement

Outside, waiting for the tram, you open your notes app and type one line: Review the API like a survey, not like a panic.

That is all it takes. A survey has an order. It goes room by room. It writes down what it finds, including the boring this is fine. It does not need you to be a security genius. It needs a list, a calm hour, and somewhere to record what you saw, so that next month's version of you does not start from zero.

Someone could even hand you that list. The thought is almost funny. You have been treating this as a personal test of nerve, when it can be a checklist job.

A Monday that feels different

Picture the next Monday.

You open the project with coffee, not dread. There is a sheet beside it, and some of its rows are already ticked. A few say needs a closer look, with a date next to them. None of that is frightening. A short, honest list of things to fix is easier to carry than a large, fuzzy worry.

When the client asks, "We're fine on security, right?", you do not reach for cardboard words. You say, "I've been through it properly. Here's what's solid, here's what I'm tightening this week." Your voice is level. They relax, because you do.

And on Sunday, at lunch, you are at the table. Just at the table.

If you recognise yourself

If you have inherited an API and the honest answer to "is it secure?" is "I think so, nobody's complained", you are in good company. It says nothing about your skill. It means nobody gave you a way to look.

We made the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for that moment. It is a 58-item review kit with a PDF and an XLSX tracker, curl tests you can run yourself, an auth-route scanner script, and a client report template. It covers Node/Express and Python. It is a tool for organising your review, not a guarantee, and it does not replace a professional security audit when your situation calls for one. It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

If it sounds like the survey you have been meaning to book, you can take a look here.

Either way, label the switches. Future you will be grateful.

An illustrative story, written with AI assistance.