Junior Dev Built Our API, Safe to Launch? Cake Tasting

2026-10-30

Saturday, 11:20 am. A bakery with a chalkboard menu and a small plate of lemon sponge in front of you.

Your partner is explaining why the second tier should be the elderflower one. You nod. You are holding the fork, but your head is somewhere else.

Your phone buzzes face-up next to the napkin. It's Lena, the junior developer you hired in spring. All endpoints done! Ready for Friday whenever you are 🎉

You smile at the screen. You really are proud of her. She built the whole thing in four months, mostly alone.

Then the second thought arrives, quietly, like a draught under a door: How would I know if it's safe?

The question you can't ask out loud

You run the company, so you're the one who says "go". But you don't write the code. You can't read it well enough to judge it, and you don't want to sound like you doubt her.

She's good. She's careful. She also has never shipped something real to real customers before. Neither, really, have you.

So what exactly are you supposed to ask? "Is it secure?" feels like asking a pilot if the plane is okay. She'd say "yes, I think so," because that's what a conscientious person says. And "I think so" is where the draught comes from.

"You've gone quiet," your partner says. "It's the cake, isn't it? It's too lemony."

"It's perfect," you say. "Sorry. Work."

You put the phone in your pocket. It makes no difference. The question just rides along.

What the worry costs you

Nobody sees this cost on a invoice, but you pay it anyway.

It's the Sunday that goes slightly grey. It's the walk past the shop window where you stop looking at the display and start rehearsing a sentence: "We've had an incident, and I want to tell you first..." You've never had to say it, but you've practised it a dozen times.

It's the way you've started to avoid asking Lena anything technical, because you can't tell whether her answers are reassurance or knowledge.

And it's a little unfair to her too. She gets a launch date and a pat on the back, but no one has ever reviewed her work or told her what "done" should mean. She's guessing as well. She just does it more quietly.

The turning point, over a second slice

Your partner has gone to the counter to ask about delivery. You're alone with the last crumbs and a thought that arrives surprisingly plainly:

The problem isn't Lena. The problem is that "safe" is a feeling right now, not a list.

If someone handed you a list, a plain one, written for people who aren't security experts, you could sit with Lena for an hour and go through it together. Not as an interrogation. As a shared piece of homework. Some items would get a tick. Some would get a "hm, let's look at that." Anything that didn't fit would end up written down instead of floating around at 3 am.

And you'd have something to show a customer who one day asks, politely, how you look after their data.

That's all. No grand audit. Just the difference between I hope and we checked.

You feel your shoulders drop about two centimetres.

The same Saturday, afterwards

Imagine the version where that list already exists.

The lemon sponge is simply lemon sponge. You tell Lena: "Brilliant work. Let's spend Tuesday morning going through the launch review together, and I'll bring biscuits." She says "sure!" and you can hear that she's a little relieved too.

On Tuesday you sit side by side, two coffees, one shared screen. Most things are fine. Two things aren't, and she fixes them by Wednesday lunchtime, without drama, because a list made them ordinary instead of embarrassing.

Thursday you don't sleep badly. Friday you press the button with a calm stomach.

And the following Monday is just a Monday. You open your inbox expecting the usual: a supplier, a question about delivery times, a newsletter you never signed up for. Nothing in there makes your pulse jump. You're not scanning for the sentence you rehearsed on the walk past the shop window.

That's the whole difference. Not a perfect system, since nobody has one. Just knowing what was looked at, and what was written down for later.

If this is your Saturday

If you're the founder, the freelancer or the lead who has to say "go" about something you didn't build yourself, you're not being paranoid. You're being responsible and a little under-equipped, which is fixable.

We put together the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for exactly that moment. It's a 58-item review kit for Node/Express and Python APIs, with a PDF checklist, an XLSX tracker, curl tests, an auth-route scanner script and a client report template. You can work through it with a developer, or alone, and end up with a written record of what was checked.

It supports your review. It doesn't replace a professional security audit, and you stay in charge of the decisions. If it doesn't help you, there's a 30-day money-back promise, no questions asked.

And if you're not there yet, that's fine too. Finish your cake. Tell Lena she did a great job. The checking can start on Tuesday.

An illustrative story, written with AI assistance.