Postman Data Leaks: The Hidden Risks Lurking in Your Workspaces

CloudSEK's TRIAD team reports that over 30,000 publicly accessible Postman workspaces exposed sensitive information—API keys, tokens, credentials, and PII—across many services (Okta, Zendesk, Razorpay, New Relic, GitHub, Slack, etc.), demonstrating how misconfigured sharing, plaintext storage, and long-lived tokens can enable data breaches, unauthorized access, and financial fraud; the report includes case studies, a reproduced New Relic POC, and recommended mitigations.