I wrote up my findings on this late last night, so I would greatly appreciate anyone who might be able to give me an independent sanity check that this is actually what's happening.

There is a reason why it is now a forbidden tool in many corporations.

I don't get why people still use postman when you have nice open-source tools such as Bruno [0], which actually can do a lot of what postman does, and more than that you can even import your postman collections.

[0] : https://github.com/usebruno/bruno