Apparently CodePen 2.0 sends data to their servers as you type
They send all typed into editor input to codepen.dev almost immediately (you would see in 1-2 sec after you typed your secret that it appears in respective Network/Response tab) even before one saved it. I tested this with a unique marker: after typing it into index.html, CodePen ran a build with "save:false", and the marker then appeared verbatim in the HTML served from the generated "*.codepen.dev preview". Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen
Discussion Highlights (14 comments)
keepo404
because this is how autocomplete logic works i guess? Frontend cannot guess language and completions for you
bashy
Sent to them to render the preview pane. Same as pasting secrets anywhere on a browser. Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.
tvink
You're gonna be shocked how many input fields do this for various UX features :)
pdyc
i made my own html playground that is browser only and shares preview via url hash because of these useless shenanigans of codepen, its not as featureful but i mostly use it for sharing single page html files https://easyanalytica.com/tools/html-playground/
cph123
For basic previewing I like to use https://htmledit.squarefree.com which has been online for years and does it all client side.
nseskin
There’s a detailed discussion of the same issue here https://www.reddit.com/r/webdev/comments/1rj1oac/i_planted_f...
midnitewarrior
Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time. I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.
maxim-fin
CodePen does not disclose this in neither ToS nor in Privacy Policy, only in Builds documentation they say: “As you work on CodePen, your Pens are constantly running through the CodePen Compiler”
kypro
This is so it can restore any unsaved changes. I take no opinion on whether this is good or bad, but I can see how from a UX perspective it's nice not to lose 10 minutes of work because your browser crashes or something.
giancarlostoro
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
quietraster
the 'it's just autosave' defense in the comments is interesting. is keystroke-level granularity actually needed for that though?
dbushell
I'm looking forward to the Gamers Nexus exposé
millerm
Reddit does this. Every keystroke you type into a comment box is sent back to them. So, that means even if you decided to cancel posting something, they still receive what you wrote. I have been known to write responses that were harsh and angry, and I simply don't send. Sometimes it's therapy for me to think through something while typing whatever is in my head. Then I go back and edit once I have have thought it through. I don't want that info sent back. So, I tend to not involve myself with much online anymore. I don't want to expose myself to the thought police. I find the browser the most unsafe piece of tech deployed.
mkgiga
if you paste secrets in any website you should be fired immediately