Is My Webhook Endpoint Secure? The Propped Side Door
2026-11-03
The side door of the village hall is held open with a brick.
It is Saturday, 10:20. Mira is carrying a folding table across the parquet floor for the repair café, and the hall smells of floor polish and toast. A man with a toaster under his arm walks in through the side door, nods, and sets it down. Nobody asks his name. Nobody should. It's a repair café.
"Anyone could just walk in here," says Hanne, who runs the kettle. She laughs. "That's the point."
Mira laughs too. Then her stomach does something small and unpleasant.
The address she gave away on Thursday
On Thursday she had finished a job for a client who sells ceramics online. When an order comes in, the shop sends a message to a web address Mira built, and her little service reacts: it marks the order as paid, sends the confirmation, and tells the warehouse shelf to count one less.
It worked on the first try. She sent a happy message, the client sent back a clapping emoji, and she closed the laptop feeling like a professional.
Now she stands in a village hall holding a folding table, and the thought arrives complete: that address is a door. What did I put on it?
She can't remember writing anything that asks who is knocking. She remembers the address being long and ugly. She remembers thinking nobody would guess it. That is exactly what Hanne's brick is: a plan that depends on nobody trying the handle.
The question you can't ask out loud
You know this feeling if you've built anything that talks to the internet. It isn't panic. It's a low hum that follows you around a Saturday.
You smile at the toaster man. You help someone find an extension lead. Underneath, a quiet voice keeps asking: if somebody sent my endpoint a message that looked like an order, would it believe them? Could a stranger mark something as paid? Would I even know?
You can't ask your client, because the whole reason they hired you is that they don't have to wonder. You can't really ask a friend either, because the question sounds like "did I do my job properly?" and nobody enjoys saying that out loud.
So you do what most people do. You open the code on your phone between cups of tea, scroll, and squint. It looks fine. It always looks fine when you wrote it yourself.
Why "it works" isn't the same as "it's safe"
The cruel part is that everything is quiet. No error and no angry email. Orders keep arriving, the clapping emoji is still the last message in the thread.
A door that anyone can open looks exactly like a door nobody has opened yet.
That is what costs you the weekend. The worry doesn't come from anything that went wrong. It comes from not knowing, and not knowing has no end. You could check forever and still feel unfinished, because you were never sure what "checked" would even look like.
The moment it stops being a feeling
At 11:45, Hanne hands Mira a mug and says, "You've been staring at that brick for ten minutes."
Mira tells her. Not in technical words, just: "I gave someone an address that does important things, and I'm not sure it checks who's calling."
Hanne thinks about it. "When we lock up here, I don't feel whether it's locked. I walk the same round every time. Side door, back door, cellar, windows. Same order. Then I know."
That's the whole turning point, and it fits in a sentence: Hanne doesn't trust her feelings about the doors. She trusts a round she walks the same way every time.
Mira had been trying to feel her way to certainty. What she needed was a list to walk, one that tells her what to try, in what order, and what a good answer looks like. Then "is it secure?" stops being a fog and becomes a handful of small doors, each with a yes or a no.
A different Monday
Picture the Monday after that.
Mira sits down with her coffee, not her dread. She walks the round. Some doors are fine. One isn't, and she finds it in ten minutes instead of in a bad message from a client three months from now. She fixes it, ticks it, and sees the row turn from a question into a finished thing.
Then she writes the client a short, calm note saying what was checked and what was changed. It's the kind of note that makes a client think: good, someone is minding the doors. She doesn't have to defend herself, and she doesn't have to hope.
The next Saturday she carries a folding table across the parquet floor and thinks about nothing but where it goes.
The brick, by the way, is gone. Hanne swapped it for a proper door-closer. It took five minutes and a screwdriver.
If you recognise the brick
If you have an address out there that does real things, and you can't say for sure who's allowed to call it, you don't need to be scared. You need a round to walk.
That is what the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is for. It's a 58-item review you can work through at your own pace: a PDF and an XLSX tracker so you can see what's done, curl tests to try the handles yourself, a script that looks over your auth routes, and a report template for telling a client what you checked. It covers Node/Express and Python. It's a way to organise a review, not a replacement for a security professional, and if it doesn't help, the 30-day money-back promise covers you, no questions.
An illustrative story, written with AI assistance.