Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
I don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?
It's also a foolish thing to do. Any time anyone types anything into anywhere on any webpage, that data is as good as gone, it's out there. Back in the 90's I experimented with per-character logging on all form input boxes, just because I could. That's still possible today.
Comments
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
Yes, that is for autosave and for rendering
Edit: The point is that any secrets typed/pasted in there should be considered compromized
I don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?
Copy -> paste -> redact secrets
That flow would be considered unsafe, and probably common.
It's also a foolish thing to do. Any time anyone types anything into anywhere on any webpage, that data is as good as gone, it's out there. Back in the 90's I experimented with per-character logging on all form input boxes, just because I could. That's still possible today.
This is exactly the scenario I pictured
If you are pasting secrets into codepen you are probably really terrible at all other basic security practices.