Did I Miss an API Security Check? The Handover Call at 10 am

2026-10-13

The client's face fills half your screen. Behind her, a bookshelf and a half-dead plant. On your side, a terminal, a green test run and a cup of tea that went cold twenty minutes ago.

"So we can go live today?" she asks.

You say yes. Your voice sounds fine. Your stomach does not agree.

The API works. You know it works. You built the endpoints, you tested the happy paths, you even wrote the README. But somewhere behind the yes, a small voice keeps asking the same thing it asked at breakfast: did I miss something?

The yes that costs you

Nobody sees this part of freelance development. The client sees a smooth handover. You feel a low hum under it.

Was that one route behind login? Did you really check the one you added on Thursday, the quick one for the export? What happens if someone sends it something strange? Does the error message say too much?

You are not careless. That is the odd thing. People who worry about this are usually the ones who care. But caring without a clear list turns into a vague dread, and vague dread is expensive.

It costs you the lightness of the day a project ships. It costs you the walk afterwards, because you keep half-checking in your head. It costs you a bit of your standing in your own eyes: a real professional would just know.

You are alone on this project. There is no second developer to say "I looked at that, it's fine." No security team. Just you, and the call, and the plant.

What you do instead of asking

So you do what many of us do. You say, "Give me five minutes, I'll do one last check."

The client smiles and mutes herself. You open the code and start scrolling, hoping something will jump out.

Nothing jumps out. That is not the same as everything being fine. You scroll through files you wrote weeks ago, and they all look reasonable, because they look like your code. You are checking your own homework with the eyes that wrote it.

After eight minutes you unmute. "Looks good," you say.

It probably is good. But "probably" is a heavy word to carry into someone else's business.

The quiet realisation

Here is what changes things, and it is not a clever trick.

The problem was never that you don't know enough. The problem is that you were trying to remember, in the moment, everything that could matter. Memory is a poor place to keep a pre-launch routine. It gets tired. It skips the boring things. It gets loudest exactly when the client is waiting.

Pilots do not rely on feeling confident before takeoff. Surgeons do not either. They use a list, not because they are beginners, but because the stakes are real and the mind wanders. A list is what experienced people use.

The moment you see that, something loosens. You were never supposed to carry it all in your head. You were supposed to have somewhere to put it.

The same call, a different Monday

Picture the same handover, a few weeks later, a different project.

The client asks, "Can we go live today?"

You say yes, and it is a plain yes. Because yesterday afternoon you sat down with a finished review, every line ticked or noted, and the two things you found were already fixed. You didn't hunt for them in a panic. They were simply on the page, waiting to be seen.

The call lasts twelve minutes. Afterwards you do not hover over the terminal. You close the laptop, carry the cold tea to the kitchen, and make a fresh one. Maybe you take a walk, and for once you are only walking.

There is one more small thing. When the client says, "How do I know it's been checked?", you do not fumble. You send her a short, tidy summary of what was reviewed. It reads like the work of someone who runs a proper business, because you do.

Nothing dramatic happened. You just stopped improvising the most nerve-racking part of the job.

Not a guarantee, a steadier footing

Be honest with yourself about what a checklist is. It does not make software unbreakable, and no list ever will. It does not replace a specialist if your project handles something truly sensitive. What it does is smaller and more useful: it makes sure the ordinary, well-known things are not forgotten on a day when your head is full of other people's expectations.

Most of the dread was never about exotic attacks. It was about the fear of having skipped something basic. A calm, repeatable review answers exactly that fear.

If you recognised yourself

If you have ever said "looks good" with a small knot in your stomach, you might like having the whole routine in one place. We made a kit for exactly that moment: Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit. It has 58 review items as a PDF and an XLSX tracker, curl tests you can run, a script that scans your auth routes (for Node/Express and Python), and a client report template for the handover.

It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

See the REST API Security Checklist Kit

An illustrative story, written with AI assistance.