Pen Test Next Week, Unsure Your REST API Is Ready?

2026-10-23

The calendar invite has been sitting there since last Wednesday. Penetration test – external – Tuesday 09:00.

It is Thursday, 10:25, and you are on mute in the team stand-up. Someone talks about the sprint board. You nod at the right moments. Behind the nod, one thought loops: Is my API actually ready?

You built most of it yourself. The Express routes, the token handling, the little admin endpoint you added in a hurry in spring. You remember writing it. You do not remember whether you ever locked it down properly.

The feeling nobody puts in the ticket

Nobody asks, "How are you feeling about Tuesday?" The question on the board is "Is the test environment ready?" And yes, it is. It is up. It responds.

But responds is not the same as ready.

After the stand-up you open the project and scroll through the routes file. It is long. You read a few lines, get pulled into a function you wanted to refactor anyway, and twenty minutes disappear. You close the tab with the same knot in your stomach, just a little tighter.

This is the part that is hard to explain to anyone outside the work. You are not lazy. You are not careless. You simply have no map. You have a vague sense of things you should have checked: who can call what, what happens with a missing token, what the error messages give away. But "vague sense" is a poor thing to carry into a room where someone is paid to find the gaps.

What the dread quietly costs

It costs Thursday afternoon, for a start. You keep half-checking things instead of finishing the work you are meant to be doing.

It costs Friday evening. You are at the supermarket, standing in the queue with a basket of pasta and oat milk, and you catch yourself running through endpoints in your head. Did the old v1 routes ever get switched off?

It costs a little of your standing, too, at least in your own mind. If you are a freelancer, the report goes to a client with your name on the build. If you are in a small team, it goes to the person who trusted you with it. Either way, you picture the findings list and your stomach drops. Not because a finding is a disaster. Findings are normal. But because you would rather have found them first.

And there is the sleep. Not dramatic insomnia. Just waking at 5:40 with the word "authorization" already in your head.

The Saturday you stopped guessing

On Saturday morning, with coffee going cold next to the keyboard, you did something small. You stopped trying to remember everything and asked a different question: what would a careful person check, in what order, and how would I know I had checked it?

That was the turn. Not a burst of genius. Just the realisation that the problem was never your skill. It was that the whole review lived in your head, and your head is a poor place to keep a list of fifty-odd things.

A list on paper does not get tired. It does not skip the boring item because the interesting one is more fun. It does not let a Thursday-afternoon worry stand in for an actual answer.

You would still be the one deciding what matters. But you would not be deciding it from fog.

Monday, 08:50

Picture the Monday before the test, the way it could feel.

You make tea. You open one tracker instead of forty tabs. Most rows are already ticked. A few say fix and have a note beside them in your own handwriting, so to speak. One or two say not sure, and you know exactly which ones, so you can mention them to the tester instead of hoping they stay hidden.

Nothing about it is perfect. That is fine. What has changed is that you are no longer guessing. You know the shape of your own work.

On Tuesday at nine, the test starts. You are at your desk with a sandwich in the bag and the usual Tuesday noise around you. When the first message comes in from the tester, your pulse does not jump. It is just a message.

And later in the week, when the report arrives, it reads like a conversation you had already half-had. Some items you saw coming. A few surprise you, because that is what outside eyes are for. None of it feels like an ambush.

You close the laptop at six. The pasta queue thoughts are gone.

A gentle next step

If you recognise yourself in the Thursday stand-up, there is a small kit we made for exactly this moment: Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit. It is a 58-item API review in a PDF plus an XLSX tracker, with curl tests, an auth-route scanner script and a client report template, for Node/Express and Python.

It will not replace a professional pen test, and it does not promise your API is secure. It gives you a clear map to walk through before someone else does. If it does not help, there is a 30-day money-back promise, no questions.

See the REST API Security Checklist Kit

An illustrative story, written with AI assistance.