Ayush Panwar

Sensitive data leaks in Postman workspaces pose significant risks, exposing API keys, credentials, and tokens that can lead to unauthorized access, data breaches, and reputational harm. A year-long investigation revealed over 30,000 publicly accessible workspaces leaking sensitive information, including business data and customer PII. Improper access controls, accidental sharing, and storing data in plaintext were major contributors to these vulnerabilities. Adopting best practices like using environment variables, limiting permissions, and implementing external secrets management is critical to mitigate these risks and secure collaborative development environments.