In this paper we report on research exploring the privacy, security and safety implications of children being able to program Internet of Things devices. We present our methodology for understanding the contexts in which children may wish to use programmable IoT, identifying risks that emerge in such contexts, and creating a set of questions that might guide design of such technologies so that they are safe for child users. We evaluate the success of the methodology, discuss the limitations of the approach, and describe future work.