Postman Workspaces Leak 30000 API Keys and Sensitive Tokens

CloudSEK’s year-long investigation found more than 30,000 public Postman workspaces leaking sensitive data—API keys, access/refresh tokens, and admin credentials—affecting organizations across sectors and exposing services such as GitHub, Slack, and Salesforce; causes include misconfigured access, plaintext secrets, and accidental public sharing, and recommended mitigations are environment variables, token rotation, and dedicated secret-management tools while Postman has begun enforcing secret-protection policies.