---
title: "Postman is logging all your secrets and environment variables"
url: https://daily.dev/posts/postman-is-logging-all-your-secrets-and-environment-variables-0rzc8mjia
source_url: https://anonymousdata.medium.com/postman-is-logging-all-your-secrets-and-environment-variables-9c316e92d424
type: article
source: "Lobsters"
published: 2025-05-18T05:37:08.278Z
updated: 2025-05-18T05:37:21.782Z
tags: ["security", "testing", "privacy", "data-protection"]
reading_time: 3
upvotes: 168
comments: 34
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Postman is logging all your secrets and environment variables

**[Lobsters](https://daily.dev/sources/lobsters)** · 3 min read · 168 upvotes · 34 comments

## Summary

Postman has been found to log secret strings and environment variables, compromising user privacy. Despite claims of protecting sensitive data, the app sends unmasked variables to its servers, posing risks especially for healthcare applications. Users are advised to block Postman's analytics endpoints to prevent data leakage.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://anonymousdata.medium.com/postman-is-logging-all-your-secrets-and-environment-variables-9c316e92d424>

## Community discussion

Top comments from developers on daily.dev.

**@kbbdy** · 14 upvotes

> I stopped using postman because of requirement to sign and login even when I work locally. Also not all features of postman are needed in my work. After looking for alternatives and checking few of them I finally chose HTTPie as most convenient and fulfilling mu needs, and that's my recommendation.
>
> I checked: [Yaak](https://yaak.app/), [Hoppscotch](https://hoppscotch.io), [Firecamp](https://firecamp.io/) and [HTTPIe](https://httpie.io/). They are all great, so everyone should take own decision, don't rely on me.
>
> I work on linux and I am using Appimage verison (no installation required, just...

**@mattredmond** · 11 upvotes

> [Bruno](https://usebruno.com) seems a promising alternative -- open source and offline first. I've been using this in place of postman for any new API testing.

**@andrscarrillo** · 9 upvotes

> Postman sucks, it requires you to sign in and now this

**@randy** · 8 upvotes

> I haven’t had a use for Postman since I learned how to use IntelliJ’s HTTP Request feature. Sure, it’s not as user-friendly, but it does everything I need it to.

**@jack\_starborn** · 7 upvotes

> Insomnia is good http client.

## Similar posts on daily.dev

- [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments
- [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments
- [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#testing](https://daily.dev/tags/testing), [#privacy](https://daily.dev/tags/privacy), [#data-protection](https://daily.dev/tags/data-protection)

[View this post on daily.dev](https://daily.dev/posts/postman-is-logging-all-your-secrets-and-environment-variables-0rzc8mjia)