I discovered this when investigating whether Postman is HIPAA-compliant (it is not).
Did you flag it / create an issue?
My main point was that I wouldn't want my secrets to ever be sent to Postman under any circumstance (or alternately, stop calling them "secret"). A lot of the online responses were some variation of "why are you sending secrets in query parameters in the first place?" (I'm not). When I posted on Reddit, it escalated to targeted harassment by people who were obviously current/former employees at Postman.
I did send out an email blast to a bunch of CIOs/CSOs in my network which went a bit "email viral" through forwarding, and this ended up triggering a substantial amount of enterprise cancellations.
The example from the blogpost: `http://localhost:4000/patient/{(SECRET}}`
Wherein the logger logs the final URL with the secret.
I think I agree with the masses? It strikes me as an odd place to put a secret.
But to your credit, they also... shouldn't be logging endpoints? Secrets or no. That's basically what this person said responding to your post: https://medium.com/@fsufitch/if-you-are-writing-this-off-as-...
> Postman is, in essence, "looking over your shoulder" and jotting down all URLs you query
news.ycombinator.com/item?id=50359814