Postman Data Leak Fiasco: 30,000 Workspaces Spill Sensitive Secrets!
CloudSEK discovered a massive leak of sensitive data from 30,000 Postman workspaces, exposing API keys and credentials. Major platforms like GitHub, Slack, and Salesforce are impacted due to misconfigured access and public sharing. To mitigate risks, use environment variables, rotate tokens, and adopt secret management tools.
Hot Take:
Well, looks like 30,000 Postman workspaces went all Oprah on us with their secrets: “You get an API key! You get a token! Everybody gets something sensitive!” Maybe it’s time for organizations to stop using Postman like it’s their personal diary.
Key Points:
- 30,000 Postman workspaces were found leaking sensitive data like API keys and admin credentials.
- Major platforms affected include GitHub, Slack, and Salesforce.
- Common causes of leaks: misconfigured access, plaintext storage, and public sharing of collections.
- Mitigation steps: Use environment variables, rotate tokens, and employ secret management tools.
- Postman has rolled out a secret-protection policy to prevent future leaks.
Already a member? Log in here