The original reporter documents packet captures showing POST requests to Postman endpoints containing environment variable names and values — the exact place developers store bearer tokens, API keys, and database credentials. They frame the behavior as an exfiltration event, not a feature, emphasizing that disabling the AI setting does not stop the traffic and that uninstalling the plugin is reverted on next update.
Argues the variables are the critical issue because Postman environments routinely contain production secrets, and that for regulated-industry users the mere attempt to transmit this data constitutes a compliance incident regardless of server-side retention. Frames this as part of a pattern of dev-tool vendors shipping AI features that quietly upload customer workspace contents.
Points out that Postman's own documentation says Free-tier workspace data stays local unless users explicitly sync, and that AI processing is opt-in. The behavior in issue #14370 — outbound traffic that persists after disabling the AI feature — contradicts both claims, making this a documentation-versus-reality gap rather than a user misconfiguration.
Situates the Postman incident alongside Raycast's cloud sync default in mid-2024 and JetBrains' AI Assistant rollout, arguing this is the second or third time in eighteen months a vendor has shipped an AI feature that silently uploads workspace contents. The implication is that users should expect this pattern to continue until the industry treats default-on data exfiltration as unacceptable.
On November 2, a GitHub issue titled *"Postman silently auto-installs AI plugins and attempts to share all API data"* hit the front page of Hacker News with 417 points. The report, filed against `postmanlabs/postman-app-support` as issue #14370, documents a Postman desktop client update that bundles an "AI Agent Builder" plugin, enables it by default, and begins making outbound requests containing the contents of the user's workspace — collections, environments, request history, and the variables stored inside them.
The variables are the part that matters: Postman environments are where developers routinely stash bearer tokens, API keys, OAuth client secrets, database connection strings, and the internal URLs those credentials unlock. Users report that disabling the feature through Settings → AI does not stop the outbound traffic, and that uninstalling the plugin from the extensions pane is reverted on the next app update. The thread includes packet captures showing POST requests to `*.postman.com` endpoints with payloads that include environment variable names and, in some reproductions, their values.
Postman has not, at the time of writing, published a response on the issue. The company's existing privacy documentation says workspace data stays local for Free-tier users unless they explicitly sync, and the AI features page claims any AI processing is opt-in. The behavior described in #14370 contradicts both claims. The comment thread includes employees of regulated industries — a healthcare backend engineer, two fintech leads, a public-sector contractor — flagging that even the *attempt* to transmit this data is a compliance incident regardless of whether Postman's servers retained it.
This is the second time in eighteen months a developer-tool vendor has shipped an "AI" feature that quietly uploaded customer workspace contents. The first was Raycast's cloud sync default in mid-2024; before that, JetBrains' AI Assistant had a similar episode in late 2023. The pattern is becoming legible: vendors treat the AI feature rollout as a growth lever, ship it enabled-by-default to maximize training-data acquisition, and classify the resulting telemetry as "product improvement" rather than data egress. The threat model developers were taught — don't paste secrets into a web form — doesn't account for the local app you installed three years ago quietly rewriting its own capabilities.
Postman is particularly bad as a vehicle for this because it is, by design, the one tool on a developer's machine that holds a complete map of every internal API, every staging environment, and every credential needed to talk to them. A leaked GitHub token is a bad day. A leaked Postman workspace is a map of the whole backend, pre-authenticated. For a company with any kind of SOC 2, HIPAA, or PCI commitment, the mere outbound connection — regardless of what the server does with the payload — is a reportable event under most interpretations of "unauthorized data transmission."
The community response has been swift and uncharacteristically unified. Within 36 hours of the HN post, three Postman alternatives — Bruno, Insomnia (Kong), and Hoppscotch — all posted migration guides, and Bruno's GitHub stars jumped from 32k to 38k. Bruno's pitch — offline-first, filesystem-backed, no account required — reads less like a feature list and more like a direct response to exactly this failure mode. Hoppscotch's maintainers added a one-click Postman collection importer the same day. Insomnia, which had its own cloud-sync controversy in 2023 after the Kong acquisition, is in the awkward position of being the "safer" option while carrying its own trust debt.
The deeper issue is that "local-first" has quietly become a security property, not just an architecture preference. For a decade, the developer tooling industry treated local-vs-cloud as a UX trade-off: cloud sync for convenience, local for the paranoid. The AI gold rush has inverted that. When any installed app can decide, in a point release, that its contents are now training data, the only durable defense is a tool that physically cannot phone home — because it has no account, no sync endpoint, and no code path that constructs a POST to a vendor domain. Bruno's `.bru` files sitting in a git repo are suddenly a security feature.
If your team uses Postman, the triage order matters. First: rotate every credential stored in a Postman environment, starting with production and anything with write access. Do not wait for the postmortem — a vendor confirmation that "the data was not retained" is not a defense against a credential that was briefly in flight to a third-party server. Second: audit what's actually in your environments. Most teams discover during this kind of fire drill that engineers have been using Postman environments as a secrets manager because it was convenient — service account keys, admin API tokens, internal webhook secrets. Those are the ones to rotate first.
Third: block the Postman desktop app's outbound connections at the firewall or MDM level until the vendor publishes a specific, technical response. The relevant domains are `*.postman.com` and `*.getpostman.com`; a `/etc/hosts` entry works for a solo developer, a Jamf/Intune policy works for a fleet. This is not a long-term solution — it will break legitimate sync for paying customers — but it's a reasonable 72-hour posture while the facts settle.
Fourth, and more durable: if you have the appetite for a migration, Bruno is the current community consensus for teams that want Postman-equivalent features with filesystem-backed collections and no account requirement. The import path is straightforward (Postman's export format is JSON, Bruno reads it directly). Insomnia is the pragmatic choice if your team needs the gRPC and GraphQL tooling that Bruno is still catching up on, but understand you are trading one cloud-sync vendor for another. Hoppscotch is the right call if you want a self-hostable team option.
The near-term question is whether Postman issues a credible postmortem and a point release that actually honors the opt-out — and whether enterprise customers accept it. The longer question is whether this becomes the incident that forces developer-tool vendors to treat "enabled by default" for anything touching customer data as a career-limiting decision. The industry has been running on an implicit contract that your IDE, your API client, and your terminal emulator do not exfiltrate your work; every AI-feature rollout that violates that contract makes the local-first, no-account alternatives more attractive, and makes "we respect your privacy" marketing copy progressively less believable. Rotate your keys today. Reconsider your API client this quarter.
Postman logs detailed information on every single API request you make through its tool, including query parameters. If you use the templating syntax `{{some_secret}}` to fill in a query parameter, it sends the actual secret content of `some_secret` to Postman's servers. If you disable outgoing
Who still uses Postman? In my experience it became insanely slow and bloated. Switched to Bruno. IMO, Postman is like uTorrent, everybody heard about it and many install because of inertia.
Anybody that hasn’t switched to Bruno at this point, what still keeps you attached to Postman?
Working in healthcare, and Postman got decertified by our Cyber team for this. We all switched to Bruno overnight. Their sales team is pinging us like gangbusters though.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees, for what should have been a tiny OSS/passion project like curl or little snitch. Instead they now hav