Good point

Yes, that is for autosave and for rendering

Edit: The point is that any secrets typed/pasted in there should be considered compromized

I don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?

Copy -> paste -> redact secrets

That flow would be considered unsafe, and probably common.

It's also a foolish thing to do. Any time anyone types anything into anywhere on any webpage, that data is as good as gone, it's out there. Back in the 90's I experimented with per-character logging on all form input boxes, just because I could. That's still possible today.

This is exactly the scenario I pictured

If you are pasting secrets into codepen you are probably really terrible at all other basic security practices.

Yes, absolutely, there are good reasons for that. The point is that any secrets typed/pasted in there should be considered compromized

Edit: but then if you you quit (or crash) without saving the pen first there is no way to recover unsaved work regardless. That is, the pen must be saved manually at least once for the user to benefit from the autosave.

Secrets pasted into any web page should be considered compromised.

please don't paste credentials into codepen

interesting!

Not sure if they are still popular but in the past they may have really slowed down the site

Now it's an entire industry. They call it "bot protection"

CodePen does not disclose this in neither ToS nor in Privacy Policy, only in Builds documentation they say: “As you work on CodePen, your Pens are constantly running through the CodePen Compiler”

Indeed, it looks like CodePen v1 was sending data to codepen.io, cpwebassets.codepen.io, and cdpn.io. Now v2 sends to codepen.dev

Yes, but codepen is for frontend devs. And devs are more likely to accidentally leak secrets because, well, they have them

Edit: accidantlay -> accidentally

Yes, that is for rendering Edit: and as "kypro" pointed out also for saving the current work but if you you quit (or crash) without saving the pen there is no way to recover unsaved work regardless

No autocomplete involved there.