> some variation of "why are you sending secrets in query parameters in the first place?" (I'm not)

The example from the blogpost: `http://localhost:4000/patient/{(SECRET}}`

Wherein the logger logs the final URL with the secret.

I think I agree with the masses? It strikes me as an odd place to put a secret.

But to your credit, they also... shouldn't be logging endpoints? Secrets or no. That's basically what this person said responding to your post: https://medium.com/@fsufitch/if-you-are-writing-this-off-as-...

> Postman is, in essence, "looking over your shoulder" and jotting down all URLs you query