# No Insecure File Read and reading files

**URL:** <https://community.postman.com/t/no-insecure-file-read-and-reading-files/44666>\
**Category:** Help Hub\
**Tags:** newman-project, tests, file\
**Created:** [March 2, 2023, 12:56pm UTC](https://community.postman.com/t/no-insecure-file-read-and-reading-files/44666 "2023-03-02T12:56:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lampei](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lampei/32/11897_2.png) [@Lampei](https://community.postman.com/u/Lampei)\
**Post date:** [March 2, 2023, 12:56pm UTC](https://community.postman.com/t/no-insecure-file-read-and-reading-files/44666/1 "2023-03-02T12:56:19Z")

</div>

I am trying to understand what this flag is actually doing and preventing when using postman/newman. I found it in the UI and see that there is a flag that can be passed when calling newman via my pipeline.

.option(‘–no-insecure-file-read’, ‘Prevents reading the files situated outside of the working directory’)

If it is possible to read files from the file system, how is this done? From everything I have seen up to this point, the general consensus is that you cannot read files outside of the sandbox that is Postman other than making API calls in a request. It also sounded like reading files is only possible for using as “data” within a request. Is that “data” available in the pre-request or test scripts of a test?

I (somewhat) have worked around this by stuffing various JS files as variables into my globals file, then doing the IIFE approach to work with it.

I guess my big question is, if the file is local to the postman/newman collection/run, is it possible to read in a file into postman? If not then, what is the point of the --no-insecure-file-read as it seems you already cannot ready files outside of the current working directory? And how would I even set this flag to something else within newman? Would it be --no-insecure-file-read $false or is that still just turning no-insecure-file-read “on”?

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [April 7, 2025, 5:11pm UTC](https://community.postman.com/t/no-insecure-file-read-and-reading-files/44666/2 "2025-04-07T17:11:54Z")

</div>

Thanks for your post, and sorry we didn’t get to this sooner. This isn’t the experience we want for our users.

Since the post is a bit older, we’re closing it to make room for newer discussions. If you’re still experiencing this or have new details to share, we’d love for you to start a new discussion.