Secret scan and audit log

Tools → Scan for Secrets (also in Settings → Security and the Export dialog) looks for credentials typed directly into requests:

• AWS, GitHub, Slack, Stripe and Google keys, private keys and JWTs;
• passwords in URLs, and token, key and password query parameters;
• plain-text auth fields and Authorization, Cookie, key, token and secret headers (in requests and in saved examples);
• secrets in scripts and bodies;
• sensitive-looking variables that aren't marked secret.

Findings are graded high, medium or low. For headers, auth fields, URLs and variables, one click moves the value into a secret variable (keeping prefixes like Token {{…}}) or marks the variable as secret; the rest are edited by hand. Discovery sources, settings and history aren't scanned.

Tools → Audit Log keeps a local record (audit.log, rotated once at 5 MB to audit.log.1) of app starts, sign-ins and locks, lock setting changes, exports and imports, requests sent and compared, WebSocket connections, collection and monitor runs, mock servers, team syncs and AI access calls. It records who, when and what. Request entries store the request's name, method, host, path, status and any error, never headers, bodies or query values. The viewer shows the newest 1,000 entries. You can filter, export (JSON Lines) or clear it; clearing is itself recorded.