Postman silently auto-installs AI plugins and attempts to share all API data

Original Article ↗ Hacker News Discussion ↗

Developers are reacting strongly to revelations that Postman now auto-installs AI plugins, proxies API traffic, and logs sensitive request data by default, behavior many see as a privacy and security breach. What started as a simple GUI for HTTP requests is widely described as a textbook case of “enshittification,” driven by heavy venture funding, forced logins, cloud lock-in, and aggressive monetization. Many contributors report abandoning Postman for alternatives like Bruno, Insomnia, Yaak, JetBrains/VS Code HTTP clients, or even custom scripts and LLM‑generated tools, arguing that lightweight, local‑first options now offer everything they need without the data‑harvesting risk.

Postman’s Behavior and Trust Issues

  • Many see Postman’s silent auto‑installation of AI plugins and routing/proxying of API calls as a serious breach of trust and security.
  • Several comments claim Postman logs detailed request data (including parameters and even templated “secrets”) to their servers; some note that blocking this telemetry reportedly breaks core functionality.
  • People in regulated environments (healthcare, GxP, HIPAA-like contexts) report Postman being banned or “de‑certified” for compliance reasons.
  • Users also resent dark‑patterny UX: forced logins, cloud-only features, removed exports, and friction when trying to get data out.

Perceived “Enshittification” and VC Incentives

  • Strong consensus that Postman followed a familiar trajectory: simple local tool → VC funding and huge headcount → need to justify multi‑billion valuation → push logins, cloud sync, data harvesting, AI upsells.
  • Many frame this as a textbook case of “enshittification” driven by venture capital and growth‑at‑all‑costs incentives.
  • Some argue this is systemic to modern capitalism/tech (late‑stage SaaS, private equity, index-fund pressures), not unique to Postman.

Alternatives and Migration

  • Common replacements: Bruno, Insomnia (older versions), Yaak, Kreya, Hoppscotch, JetBrains/VS Code/Emacs HTTP clients, RESTer, Hurl, httpie/xh, httpyac, resterm, Milkman, custom curl/bash/Python/Jupyter scripts.
  • Bruno and other “simple” tools are praised for local‑first, git‑friendly text formats, no mandatory accounts, and lighter resource use.
  • However, several note Bruno and others are also VC‑backed or have pricing pages, prompting fear they may follow the same path.
  • Some teams have already banned Postman organization‑wide and migrated collections to other tools.

Role of GUI Clients vs. CLI/Code

  • Split opinions: some consider Postman-type tools essential for non‑CLI users, testers, and demoing APIs; others see curl, IDE clients, or small scripts as strictly superior.
  • Several emphasize that API behavior should be covered by automated tests; GUI clients are seen as secondary for ad‑hoc exploration.

AI/Agents as Replacement

  • Many suggest that with LLMs/agents it is now trivial to “vibe‑code” a Postman‑like client or generate bespoke curl/scripts and HTML harnesses.
  • Some foresee off‑the‑shelf API clients losing relevance; others worry about a future of fragile, one‑off AI‑generated tools and security risks.