Snapshot 232949
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Postman Incident : inc-163-postman-bot-signup-abuse Customer Trust Portal Start your security review View & download sensitive information Overview Welcome to the Postman Customer Trust Portal, where you will find downloadable documents on product security, privacy, compliance, and reliability. Documents are available to current customers or prospects. If you’re looking for general security information, please see our security page: https://www.postman.com/security/ Data security is a shared responsibility between Postman and its users. Learn how you can help keep your data secure and private: https://www.postman.com/security/shared-responsibility/. Regulatory Compliance and Standards CCPA Cloud Security Guidance CSA STAR GDPR PCI DSS SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP Certi-Trust ISO 27001 Common Criteria HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 SOC 2 Type 1 Customer Trust Portal Updates Postman Incident : inc-163-postman-bot-signup-abuse Incidents Postman is an API development platform. On November 4–5, 2026, an automated bot attack evaded our prevention mechanisms and created a large number of Postman accounts using email addresses that did not belong to the attacker. If you received an account verification email from Postman for an account you didn’t create, please delete it and do not click the verification link. No other action is needed from you. Postman has put controls in place and stopped the attack, and will delete the accounts created this way. These bots only created new, empty accounts. They were not given access to any data, and no existing Postman account was accessed. If you use Postman with a different login account, your Postman account and data was not impacted. If you do not use Postman, you will not have an account with us. If you have questions, please contact Support@Postman.com. Postman Cyber Security Incident : Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) Vulnerabilities Summary On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x. A process that decompresses attacker-controlled Brotli data can be made to disclose memory or execute code with that process’s permissions. The flaw is in the Brotli library itself, so any software bundling the same decoder is affected. Postman’s status Postman deployed WAF rules on October 22, 2026 that block the inbound attack vector across its production services. Postman is also rolling the patched Node.js versions across its managed runtimes and will update this page as that completes. Following investigation, there is no evidence that any Postman customer user data or content was affected. Cyber Event : eMudhra Intermediate CA Key Compromise Vulnerabilities Impact to Postman As of November 4, 2026, Postman has found no evidence that Postman systems, credentials, customer data, or API traffic were compromised as a result of the eMudhra intermediate CA key compromise announced in October 2026. Some versions of the Postman desktop app include eMudhra certificates in their built-in list of trusted certificate authorities. Until it’s updated, an affected app could accept a fraudulent certificate issued under the compromised intermediate when it connects to an HTTPS endpoint. Postman is releasing updates that remove this trust. The table below shows the fixed version for each release line. What you should do Update the Postman desktop app to the fixed version for your release line. Team administrators who manage Postman installs centrally should push the update to all users. Fixed versions | Release line | Postman | Postman Enterprise | | v12 | v12.33.3, v12.34.4 | v12.34.0-enterprise01 | | v11 | v11.117.0 | v11.112.2-enterprise01 | | v10 | v10.24.27-261029-1253 | v10.21.2-enterprise01 | | v9 | Web: v9.50.5-261029-1250 | Desktop: v9.31.32-261029-1251 | v9.31.32-enterprise01 | News Event: PHP2Shell vulnerability : CVE-2026-109618 and CVE-2026-109619 Review Incidents Postman has completed its investigation. Postman products, including our Enterprise offerings, are not affected. We have found no evidence of impact to customer data or content, or the availability of Postman services. As a precaution and in accordance with our Vulnerability and Patch Management Policy and our Security Incident Response Policy, we have patched any internal tools that ran affected PHP versions. This exploit is still evolving, so we continue to monitor our environment and the PHP security bulletins, and we will respond promptly to any new findings. As of October 22, 2026, Postman's investigation into CVE-2026-109618 and CVE-2026-109619 is ongoing. Based on our assessment to date, Postman has confirmed that its products, including Enterprise offerings, are not affected, and has found no evidence of impact to customer data, customer content, or the availability of Postman services. Customers do not need to take any action within the Postman platform. In line with our Vulnerability and Patch Management Policy and Security Incident Response Policy, we continue to monitor our production environment for indicators of exploitation through centralised logging and alerting, are engaging vendors through our Third-Party Risk Management process to confirm their status and identify any downstream impact, and continue to apply security updates and hardening measures across our wider environment as a precaution. Our investigation remains open and we will update this notice as further information becomes available. Notice of Security Incident Incidents On June 13, Postman became aware of a potential data security incident after a third-party provider, Klue, notified us that it had been compromised. Klue, a marketing-intelligence tool integrated with Postman's Salesforce and Gong SaaS platforms, suffered a security incident on its own platform, which resulted in access to Klue’s customers’ Salesforce and Gong services. Upon discovery, we immediately disabled all integrations with Klue, and launched a comprehensive investigation with the assistance of third-party cybersecurity experts. On June 17, 2026, Postman confirmed that exfiltration of customer contact data and sales information occurred between June 11-12 from its Salesforce environment via the compromised Klue service account; customer data was not accessed from Gong. During our review of the systems and data impacted, we discovered the following types of information had been exfiltrated by the unauthorized user: business contact and sales information such as company, name, email, title, phone number, account name, quotes, Postman user ID, team ID, and plan tier. With the assistance of third-party security experts, we conducted a thorough investigation into the nature and scope of the security incident and the data impacted. In addition to disabling all integrations with Klue, we have taken steps to remediate and further secure our environment. We are complying with our contractual and regulatory reporting obligations. Postman is aware of the cybersecurity incident impacting one of our vendors, Klue. Klue informed us earlier this week that their incident involved unauthorized access that impacted its customers through integrations with Salesforce and Gong. All access and integration with Klue and any integrated systems was immediately disabled. Pursuant to Postman’s incident response policies, we immediately launched an independent investigation as to the scope of impact to Postman systems and data. We have confirmed exposure of business contact data and sales-related data contained in our Salesforce instance. We have engaged forensic experts to determine which of our customers may have been impacted. Our core platform services remain secure and are not impacted by this incident. We care about the security of our customers' information and will provide further information as we obtain it. Security and Trust Reports Featured Documents SOC 2 TYPE 2 REPORTSData Flow Diagram (DFD) REGULATORY COMPLIANCE AND STANDARDSSOC 2 Type 2 APPLICATION SECURITYApplication Penetration Testing NETWORK SECURITYNetwork Penetration Testing AI AI Agent Mode AI Security AI Governance Policies Acceptable Use Policy Access Control Policy Asset Management Policy View more SOC 2 Type 2 Reports Data Flow Diagram (DFD) Pentest Report SOC 2 Report View more Product Security Audit Logging Data Security Integrations View more Risk Profile Data Access LevelInternal Impact LevelModerate Critical DependenceNo View more Data Security Access Monitoring Data Backups Enabled Data Encryption in Transit and at Rest View more Application Security Application Penetration Testing Secure Development Training Software Security View more Legal and Data Privacy Sub-processors Cookie Notice Global Data Privacy Frameworks View more Access Control Employee Access Management Logging Password Security Infrastructure and Cloud Security Status Monitoring Business Continuity and Disaster Recovery Infrastructure Security View more Network Security Attack Prevention and Mitigation Firewall Network Penetration Testing View more Corporate Security Employee Training HR Security Incident Response View more Sub-processors