Security fixes are released against the latest published version of @postman/postman-mcp-server. Please upgrade to the latest version before reporting an issue.

Please don't report security vulnerabilities through public GitHub issues, pull requests, or the Postman Community forum.

Report privately through either of these channels:

• GitHub private vulnerability reporting — Report a vulnerability (also reachable from the Security tab of this repository).
• Postman security — via the Postman security policy.

The more of this you can provide, the faster we can confirm and fix:

• The version of the server, and how you installed it (npx, npm, Docker, .mcpb bundle, or the remote server at mcp.postman.com).
• The toolset in use (--minimal, --code, --full, --learn).
• The impact — what an attacker can do, and what access they'd need to do it.
• Steps to reproduce, or a proof of concept.
• Any suggested mitigation, if you have one.

Don't include live API keys, tokens, or private collection data in your report. Redact them, and rotate anything that may have been exposed.

We'll acknowledge your report, keep you updated as we investigate, and coordinate disclosure with you before publishing a fix. If you'd like credit in the advisory, say so and tell us how you'd like to be named.

This policy covers the Postman MCP Server distributed from this repository.

Vulnerabilities in the Postman platform or the Postman API itself — rather than in this server — should go through the Postman security policy, which covers Postman's bug bounty and disclosure process.