Postman Secrets and Sensitive Data Exposure Audit (Defensive)
Check collections, environments and exports for exposed credentials or personal data.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review our Postman workspace for exposed secrets and personal data as a defensive review of my own workspace. Workspaces and who can access them (public, team, private): [WORKSPACES]. Variables and how sensitive ones are stored (types only): [VARIABLE_TYPES]. Examples of responses saved in collections (anonymised descriptions): [SAVED_RESPONSES]. Sharing and export practices: [SHARING_PRACTICES]. Check for tokens or passwords in variable values, headers or scripts; real customer data in saved example responses; public workspaces with internal APIs; shared environments with real values; exported files stored in repositories or chats; and old collections with leftover credentials. Rate each by risk. If any secret may have been exposed, the response is to revoke and rotate it at the source, not just delete it from the collection. Return a table with Finding, Risk, Fix and Owner, a response procedure, and prevention: secret variable types, scanning tools and training. Be practical and mark uncertainty and settings [VERIFY]. Do not ask me to paste actual secrets or data.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.