An environment file with no secrets in it

A Postman environment holds a base URL and a token, and the token is the reason these files leak.

{
  "name": "staging",
  "values": [
    { "key": "base_url", "value": "https://staging.example/api" },
    { "key": "token", "value": "", "type": "secret" }
  ]
}

An empty value with the secret type is the committed template, and the real value comes from an override at run time or from the local environment a person keeps. Postman’s own secret type hides the value in the interface and still exports it, which is a distinction worth knowing before trusting it. Scanning the repository history for anything that looks like a token is worth doing once, because this is a file people commit before thinking.