When you send a POST request to your server, you think you're sending the information to YOUR server, right? That was the default behaviour - as it should be. After updating the Postman client, I noticed Postman also sends the request to their internal servers, which then sends your server the actual request (proxying). I thought I was paranoid until another commenter confirmed the same (https://news.ycombinator.com/item?id=50358055). It's fucking annoying that something called POSTman does anything but that. Please don't use Postman for anything sensitive. It's borderline spyware, especially when you didn't consent to this behavior.

First I've seen of this, thanks HN. Almost every SAAS I've worked with this year has used Postman or offered a Postman collection, so a bit surprised this isn't more widely appreciated.

Is Bruno the general replacement now, for general purpose / enterprise users?

Is this only an issue with the web version, rather than the desktop client?

Absolutely abysmal situation. Postman has lost my trust.

Hurl was always my preferred tool. Very dumb, very Unixy. Then there is Insomnia, and HTTPie. Really no reason to use Postman.

hell no, just did some digging after reading this, unfortunately you are right. Goodbyes to Postman

Gigantic discussion (1084 points, 10 hours ago, 359 comments) https://news.ycombinator.com/item?id=50354960

Includes suggested replacements, lots of bots, accounts saying enshittification. The whole nine yards

i didn't expect postman to be doing this, will keep this in mind. thanks