just going to leave this here; I have not reproduced the claim personally (on a train right now) but uhhhhh somebody should anonymousdata.medium.com/postman-is-l... - ThreadSky

ed3d.net • 15 days ago

just going to leave this here; I have not reproduced the claim personally (on a train right now) but uhhhhh somebody should

https://anonymousdata.medium.com/postman-is-logging-all-your-secrets-and-environment-variables-9c316e92d424

Comments

sayyestono.bsky.social•15 days ago

Well, putting secrets in your url is pretty bad, which someone found out. I mean, still gonna host-file their servers, but the fault is on the dev here imo.

ed3d.net•15 days ago

Postman is a tool whose enterprise selling proposition is to remove and not add skill checks to developers

sayyestono.bsky.social•15 days ago

Tried Bruno?

ed3d.net•15 days ago

I haven’t - I use curl or a Scalar page that generates a browser client, for the most part. Postman sells to enterprise though, that’s the danger here

ohdeerthermos.bsky.social•15 days ago

To me, the issue is more "what security issues aren't you considering when you haven't thought of Postman logging everything" rather than any actual secrets. Anything you're putting in a query string should be assumed as insecure

ed3d.net•15 days ago

1) query strings are under TLS, and while aesthetically and practically I’m not huge on the practice it isn’t assumed-insecure in my book

2) Postman’s messaging is not exactly at people who have an opinion on #1 and those people really need some “fall into the pit of success” which this isn’t

ed3d.net•15 days ago

I think the article puts it well: “It doesn’t matter if you set an environment variable as secret or not — whether or not it is masked on the screen, Postman will capture it … The Postman UI has a popup with a bold claim, that variables are a way to “protect sensitive data”

ohdeerthermos.bsky.social•15 days ago

I think that's correct, it's the deception around expectations that's the more pressing issue here.

ohdeerthermos.bsky.social•15 days ago

The difference between that description and reality is enough that I think "deception" isn't an unwarranted description

Posting Rules

Be respectful to others
No spam or self-promotion
Stay on topic
Follow Bluesky's terms of service

Comments

Posting Rules

Reply