points by primitivesuave 4 days ago | 0 comments
Yes - I wrote some public posts, and a Medium article which I forgot about until just now: https://anonymousdata.medium.com/postman-is-logging-all-your...
My main point was that I wouldn't want my secrets to ever be sent to Postman under any circumstance (or alternately, stop calling them "secret"). A lot of the online responses were some variation of "why are you sending secrets in query parameters in the first place?" (I'm not). When I posted on Reddit, it escalated to targeted harassment by people who were obviously current/former employees at Postman.
I did send out an email blast to a bunch of CIOs/CSOs in my network which went a bit "email viral" through forwarding, and this ended up triggering a substantial amount of enterprise cancellations.
The example from the blogpost: `http://localhost:4000/patient/{(SECRET}}`
Wherein the logger logs the final URL with the secret.
I think I agree with the masses? It strikes me as an odd place to put a secret.
But to your credit, they also... shouldn't be logging endpoints? Secrets or no. That's basically what this person said responding to your post: https://medium.com/@fsufitch/if-you-are-writing-this-off-as-...
> Postman is, in essence, "looking over your shoulder" and jotting down all URLs you query