Swagger Docs Exposed in Production? The Spare Key Label

2026-11-02

Saturday, 10:40, between the herbs and the tomatoes

Tomas is holding a tray of basil at the garden centre when his phone buzzes.

It's a developer friend. Hey, probably intentional, but your /swagger page is open to the whole internet. Just checking.

Tomas reads it twice. The basil tray gets heavier.

He built that API himself. Eight months of evenings, one small client, one app that people actually use now. Swagger was the thing that made it feel real. A tidy page with every route neatly listed, so the front-end freelancer could see what to call.

He never turned it off. He didn't even think about it.

Now he's standing next to a display of watering cans, thinking: Am I in trouble?

The thought that arrives uninvited

It isn't one thought. It's a small crowd.

What exactly can someone see on that page? Every route? Every field? The admin ones too? Did anyone already look? For how long has it been open? Does the client know? Should he tell them before they hear it from someone else?

He pays for the basil and doesn't remember doing it.

In the car park he opens the page on his phone, as if it might look different from outside. It looks exactly as helpful as it always did. That's the strange part. It's a very friendly page. It's friendly to everyone.

What it quietly costs

The weekend doesn't collapse. It just goes slightly grey.

He's at his sister's lunch, nodding at the right moments. In his head he's rereading the code. Was that route behind login? He thinks so. He's almost sure. Almost is the word that follows him through the afternoon.

That's the real price of this kind of worry. It isn't the exposed page. It's not knowing how big the question is. A public docs page can be a small thing, or it can be a clue pointing at something bigger, and from where Tomas stands, he can't tell which. So his mind gives him the worst version, for free, on repeat.

He thinks about the client. About the email he'd have to write. About how a person who builds things alone doesn't have a security team down the hall to say, oh, that, yes, we know, it's fine.

Nobody is down the hall. There's just him, and a half-eaten slice of cake.

The turning point is small and a bit boring

On Sunday evening, Tomas does something undramatic. He stops asking am I in trouble? and asks a smaller question: what would I check, in what order, if I did this properly?

The moment he has an order, the crowd in his head gets quieter.

Because here is what he realises. The docs page was never the whole story. It was a label on the spare key. Fair to ask why the label is visible. But the real question is what the door does when someone tries it without a key. Does it open? Does it ask who you are? Does it ask again for each room?

He had been treating the whole thing like a verdict. It was a list. Lists can be worked through, ticked off, and written down, so that next time there's no gap between a friend's text and a calm answer.

He doesn't need to become a security expert overnight. He needs the review he'd give a client's API, handed to himself, with a start and an end.

A different Monday

Picture the same message arriving a few weeks later.

Monday, 9:05. Coffee on the desk. The friend writes: your docs page is public, just FYI.

Tomas smiles. Not because nothing could go wrong, but because he knows what he already looked at. The routes that matter have been tried without credentials. The odd ones have been noted. The one thing he decided to leave open is written down as a decision, with a reason, instead of lurking as an accident.

He replies, Thanks, I know. It's on my list, and here's what's behind it. Then he closes the chat and goes back to the work he actually enjoys.

No grey weekend. No rereading code at a family lunch. No draft email to the client that begins, Something has come to my attention…

Just a normal Monday, which is the whole point.

If you recognise yourself in Tomas

Maybe your page isn't Swagger. Maybe it's an /api-docs, a debug route, a forgotten test endpoint. The feeling is the same: a small public thing, and a large private what if.

This isn't a reason to panic. It's a reason to have an order of things to check, so the doubt has somewhere to go besides your sleep.

That's what we built the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for. It's a 58-item review you work through at your own pace: a PDF and an XLSX tracker, curl tests you can run yourself, an auth-route scanner script, and a client report template, for Node/Express and Python. It doesn't replace a professional security audit, and it won't promise you a perfect score. It gives you a clear list, so you know what you looked at and what you decided.

If it doesn't help, there's a 30-day money-back promise, no questions.

You can take a look here: REST API Security Checklist Kit

An illustrative story, written with AI assistance.