Pentest Found API Flaws? Embarrassed in the Rain Shelter

2026-10-29

The email arrives at 17:42, in the rain, under a bus-shelter roof at the edge of a football pitch.

Jonas is there for his niece's training session, a flask of tea in one hand and his phone in the other. The subject line is polite: Penetration test report – final. The PDF is 31 pages long.

He opens it anyway. He scrolls past the summary and goes straight to the table with the coloured dots.

Two orange. One red.

His face goes hot, even in the cold.

(Jonas is an illustrative character, not a real person. But you may know him.)

The red dot with your name on it

The red one is an endpoint he wrote himself, eight months ago. It checks that you're logged in. It never checks that the record you're asking for is yours.

He remembers writing it. It was a Thursday and the client wanted the demo on Friday. The code worked, so he moved on.

Now a stranger with a laptop and a polite tone has found it in a few hours. The report is kind about it. It says common finding and straightforward to remediate.

It doesn't feel kind. It feels like being caught.

On the pitch, a child scores and the parents clap. Jonas claps a second too late.

The thoughts nobody says out loud

He doesn't think about the fix first. The fix is probably an afternoon.

He thinks: I'm supposed to be the one who knows this.

He thinks about the client who will read page 4. About whether they'll still trust him. About the other projects, the ones nobody has tested yet, and what a stranger would find there.

He thinks that real professionals don't get a red dot. Real professionals have a process. He has a good memory and a lot of Thursdays.

That is the part that stings, and it's rarely mentioned in the blog posts about security. It isn't really the vulnerability. It's the quiet verdict you hand yourself: not a real business. Just someone winging it.

For freelancers and small teams, there's no security department to share that with. There's no colleague to say, "Oh, that happens to everyone, here's how we handle it." There's you, a report, and a client who wants a reply by Friday.

What it quietly costs

The cost isn't the finding. A finding is information, and information is what you paid for.

The cost is the next three days.

The tight chest while you draft the reply to the client. The sentence you rewrite six times because you can't tell if "we've addressed this" sounds confident or defensive. The nagging question you can't answer: what else is sitting in there that I haven't looked at?

And under that, the harder one. If this had been caught by a stranger and not by you, how would you ever know what you check and what you don't?

That is where Jonas gets stuck in the rain shelter. He doesn't know what his own process is. He has habits. He has a feeling that he usually remembers things. That isn't something you can show a client.

The turn

On Sunday evening, with the fix already merged and the retest scheduled, Jonas sits at the kitchen table and does something different.

He doesn't open the report again. He opens a blank page and asks a quieter question: what would it look like if every API I ship got looked at the same way, every time?

Not a heroic audit. Not a week of dread. Just a list he can trust, written down once, so that Thursday-before-the-demo doesn't depend on how tired he is.

A list that has an answer next to each item. Checked. Not applicable. Needs work. Something he could hand to a client without his stomach dropping.

It is a small idea, and it changes how the problem feels. A pentest finding stops being a verdict on him. It becomes one more thing a good checklist would have caught earlier, and that a good checklist will catch next time.

A different kind of Thursday

Picture the same week, a few months later.

It's Thursday again, with a demo on Friday. But before the deadline pushes the quiet things aside, there's a short pass through a known list. Some items take two minutes. A couple lead to a small fix. One is marked not applicable, and here's why.

At the end there's a document with ticks, dates and notes, in plain language.

When the client asks, "Have you looked at security?", Jonas doesn't say "I think so." He sends the report and says, "Yes, here's what we checked."

And when the next penetration tester sends the next PDF, it may still contain a dot or two, because that's what testers are for. But it opens differently. He reads it at the desk, not in the rain, and he doesn't feel caught. He feels like someone who runs a real business with a real routine.

The evening is his again. He closes the laptop and goes to pick up his niece.

If this sounds like your week

If you recognise the hot face and the unanswered "what else is in there?", there's a calm way to build that routine without starting from scratch.

Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item API review kit: a PDF checklist and an XLSX tracker, curl tests, an auth-route scanner script, and a client report template for Node/Express and Python.

It doesn't replace a professional penetration test, and it can't promise you'll never get a red dot. It gives you a repeatable way to look, and something clear to show the people who rely on you.

If it doesn't help, you have 30 days to ask for a full refund, no questions.

Either way, a finding in a report doesn't make you unprofessional. It means someone looked. Now you get to build the habit of looking first.

An illustrative story, written with AI assistance.