4 ms·
Postman is logging all your secrets and environment variables
- primitivesuave 1y agoI wrote up my findings on this late last night, so I would greatly appreciate anyone who might be able to give me an independent sanity check that this is actually what's happening.
- deleted 1y ago[deleted]
- pjmlp 1y agoThere is a reason why it is now a forbidden tool in many corporations.
- az09mugen 1y agoI don't get why people still use postman when you have nice open-source tools such as Bruno [0], which actually can do a lot of what postman does, and more than that you can even import your postman collections. [0] : https://github.com/usebruno/bruno https://github.com/usebruno/bruno
- primitivesuave 1y agoThank you so much for sharing this. We're actively looking for alternatives to Postman right now, and would be heavily inclined toward an OSS solution.
- az09mugen 1y agoYou're welcome, and thanks a lot for sharing this article.
- jicea 1y agoIf you're OK with a cli app, you can try Hurl [1], it's a cli based on curl and plain text, to run and test HTTP requests (I'm one of the maintainer) [1]: https://hurl.dev https://hurl.dev
- primitivesuave 1y agoI'm officially a Hurl user - really awesome work! Captures + asserts is exactly how I want to be thinking about API testing. Also, the VSCode extensions for syntax highlighting a .hurl file, and the "Hurl runner" so I can click a button to run a test, are pretty much all the GUI I need. Thanks again for sharing this!
- lostmsu 1y agoI am using Insomnia: https://github.com/Kong/insomnia https://github.com/Kong/insomnia
- noisy_boy 1y agoI really tried to use Bruno but I lost all my work because of a bug in it - I don't think it is ready for trusting my day-to-day work to it.
- mysterious9247 1y ago[dead]