How Postman's Five-Scope Variable Model Prevents Accidental Token Leaks

Postman environment variables have two value fields — initial and current — where initial values sync to Postman's servers and can be shared across workspaces, while current values remain local to a user's machine. A common security mistake occurs when developers paste sensitive tokens like Bearer credentials into the initial value field, which can then sync and become accessible to teammates or even public workspaces. Postman resolves variables through five scopes in order of precedence: local, data, environment, collection, and global, with the narrowest matching scope taking priority. To prevent leaks, secrets should always be stored in current values only, optionally masked using the secret variable type, or kept in Postman Vault for local encryption that never syncs. In CI pipelines, exported environment files should be sanitised before committing, with actual credentials injected at runtime from a secure secret store using tools like Newman's --env-var flag.