(THE) POSTMAN CARRIES LOTS OF SECRETS

Summary from the TLDR InfoSec newsletter

Postman's Public API Network is unknowingly leaking thousands of live credentials from popular SaaS and cloud providers. The exposure of sensitive information is due to an unclear UI, ambiguous taxonomy, and the practice of publicly forking collections containing live API keys. Despite Postman's basic secret scanner, there is a significant risk of leaking secrets due to insufficient scanning and misleading terminology like "secret" environment variables.