My main point was that I wouldn't want my secrets to ever be sent to Postman under any circumstance (or alternately, stop calling them "secret"). A lot of the online responses were some variation of "why are you sending secrets in query parameters in the first place?" (I'm not). When I posted on Reddit, it escalated to targeted harassment by people who were obviously current/former employees at Postman.

I did send out an email blast to a bunch of CIOs/CSOs in my network which went a bit "email viral" through forwarding, and this ended up triggering a substantial amount of enterprise cancellations.