This article was written with AI assistance by the Blixwerk system. Originally published at blixwerkstudio.com.
The queue at the snack bar of the municipal pool moves one tea at a time.
You are third from the front. The air smells of chlorine and toasted cheese sandwiches. Somewhere behind you a starter's horn goes off, and a hundred parents cheer for children they can't quite see.
Your phone is in your hand. It has been there for ten minutes.
The message is from Jonas, your client: "Quick one before Monday. Our IT contact asked if the portal is safe against CSRF and XSS. Can you confirm?"
You read it again. Three words in, your stomach does the small drop it does in lifts.
Let's call you Mara. She is an illustration, not a real person, but you may know her. She built a client portal and a small API behind it. It works. The demo went well. And she has no honest answer to that question.
The answer you almost typed
"Yes, all fine." It's a short sentence. It would take four seconds.
You don't send it, because you can feel the gap behind it. You think you remember something about cookies. You think the framework probably does something by default. You once read half an article about escaping output and meant to go back.
"Probably" is not a word you want to hand to someone else's IT department.
"Two teas, please," says the man in front of you. You step forward without noticing.
What the not-knowing costs
It isn't dramatic. Nothing is on fire.
It's the way the gala goes past you. Your daughter swims her heat, and you cheer on time, but half of you is inside a browser tab, wondering whether a stranger's page could ask your API to do something while someone is logged in. You're also wondering whether anything you render could ever run as code instead of text.
The weekend is leaking away. So is the quiet feeling that you are good at your job.
You tell yourself you'll check on Sunday night. Then you remember last Sunday night. You opened a dozen search results, each one contradicted the one before, and you closed the laptop more worried than when you started.
The trouble was never that you couldn't learn this. The trouble was that you had no list. You didn't know what "checked" would even look like, so "done" never arrived.
The turn, between the tea and the sugar
The girl behind the counter hands over your tea and a wooden stirrer. You step aside to the little shelf with the sugar sachets.
And a thought arrives, plainly, the way good thoughts do when you stop pushing:
I don't need to be certain about everything. I need to know what has been looked at and what hasn't.
That's a smaller job, and a kinder one. It isn't "am I secure?", which has no finish line. It's "which of these questions have I answered, and what did I see when I did?"
You put the sugar down. You type back to Jonas:
"Good question. I'll go through it properly on Monday morning and send you a short written summary by lunchtime."
It's true, it's calm, and it sounds like someone who runs a real business. You press send. Your shoulders drop an inch.
What Monday could feel like
Picture it differently, just once.
It's Monday, a quarter past nine. Coffee on the desk, window open a crack. You have one list in front of you, with every item written as a plain question. Next to some of them there's a little note in your own words: checked, this is what I saw. Others say not applicable here, and you can say why.
The unanswered ones are visible, and visible is manageable. You work through them one at a time, without the fog.
By lunchtime you send Jonas a tidy summary. It says what was reviewed, what was fine, and what you tightened. It doesn't promise the impossible. It shows that you looked, and how.
His IT contact replies with a thumbs-up and one follow-up question. You can answer it, because you know where you wrote the answer down.
Then you eat lunch away from the screen. That's the part nobody puts on a checklist, but it's the point of one.
Back at the poolside
The next heat is called. You find a spot on the bleachers, tea going lukewarm in your hand, and you watch your daughter climb onto the block.
The horn goes. She is a small, determined splash.
This time you're watching her, not a tab.
If you recognise yourself in this
If you've ever stood somewhere ordinary with a question about CSRF or XSS and no honest answer, the thing you're missing probably isn't more reading. It's a finished list you can walk through once and put your name to.
That's what the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is for. It's 58 review items as a PDF and an XLSX tracker, with curl tests, an auth-route scanner script and a client report template, for Node/Express and Python. It won't replace a professional security audit, and it can't promise your API is flawless. It gives you a calm, orderly way to look, note what you saw, and tell your client clearly.
It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.
An illustrative story, written with AI assistance.
Sounds familiar? Take a look at what helps.
Top comments (0)