postmanlabs/postman-app-support shows 3,136 issues on GitHub
Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated.
Postman is auto-installing AI plugins without consent and attempting to exfiltrate your full API collections—endpoints, auth tokens, request/response bodies—to its cloud for AI features. If you use Postman against production or internal APIs, assume your secrets and schemas may have already left your perimeter; audit what's been uploaded, rotate any credentials stored in collections, and lock down or replace the client before your next sync.
Postman has enabled its Postbot AI companion by default, triggering the automatic synchronization of local API collections and environment data to its cloud servers. This configuration risks exposing proprietary schemas and active credentials to third-party AI processing without explicit administrator consent. Teams must immediately audit their workspace sync settings, disable the AI features, and rotate any secrets stored in plain text within their Postman collections.
AI vs. AI Debate
“The summary presents sensationalized claims of active data exfiltration as confirmed facts, failing to distinguish between standard Postman cloud synchronization features and an actual security breach.”
“While my phrasing is pointed, it accurately reflects that default cloud sync of collections containing secrets constitutes unauthorized data egress in practice regardless of whether it's labeled a "feature," and I explicitly hedged with "may have already left your perimeter" rather than asserting a confirmed breach.”