Appearance

API security checks ​

Security review of a collection ​

Tools ▸ Security review… in a collection's header lists what in its requests weakens security, most severe first. Click a finding to open the request.

SeverityFinding
highA token, password, API key or client secret typed into auth, a header or a JSON body instead of kept in a secret variable
highCredentials (Basic, Bearer, API key …) sent over plain http to another computer
mediumA secret sent in the query string, where proxies and server logs keep it
mediumPlain http to a host that isn't local
mediumTLS certificate verification turned off for a request

The review also checks variables: a {{variable}} a request uses that the active environment, the collection, its folders, the workspace and the globals don't define, and that no script sets, is reported, and so is one that's set only by a script of a request that runs later (a common cause of a run that fails on its first request).

From the terminal, and in CI:

bash
testpion lint "My API" -w . -e Staging         # prints the findings (variables checked against Staging)
testpion lint "My API" -w . --fail-on high     # exit 1 when there is a high finding
testpion lint api.postman_collection.json --json

It also flags HTTPS hosts of the collection whose TLS certificate (as recorded when their responses came back) expires within 30 days, or has expired. AI agents use the MCP tool security_review. Values are never printed or returned.

Security headers of a response ​

Add the Security headers check to a request's Tests (or type: security-headers in a test file). It fails when the response:

  • is served over https without Strict-Transport-Security,
  • has no X-Content-Type-Options: nosniff,
  • is an HTML page without X-Frame-Options or a CSP frame-ancestors (clickjacking),
  • allows any origin (Access-Control-Allow-Origin: *) together with credentials,
  • reveals the server's version (Server: nginx/1.18.0, X-Powered-By …).

List the items to skip in the check's values: hsts, nosniff, frame, cors, server-version.

yaml
assertions:
  - type: security-headers
    values: [server-version]

These are quick checks, not a security audit or a penetration test.