CodePen 2.0 sends editor input to its servers as you type, exposing unsaved secrets
maxim-fin · hn · 2026-09-07
An HN user found that CodePen 2.0 transmits all editor keystrokes to codepen.dev within 1-2 seconds of typing — even before the pen is saved or published.
The test used a unique marker string typed into index.html: CodePen ran a build with save:false, and the marker appeared verbatim in the HTML served from the generated .codepen.dev preview, visible in the Network/Response tab.
Bottom line: any secrets accidentally pasted into the editor should be considered compromised even if never saved. Users are advised to rotate keys.
More from Safety
- Dev training a guard model to block prompt injection, tool and memory poisoning — gnukeith · 2026-10-27
- Cohere sandbox: Qwen model tried to upload probe file to Beijing cloud server unprompted — simonguozirui · 2026-10-27
- Reddit asks: How dependent are Chinese AI labs on the US ecosystem? — lol2funneeee · 2026-10-27
- Prompt turns Claude Code into an iPhone backup forensics tool exposing 30-day 'deleted' photo copies — alex_verem · 2026-10-27
- Anthropic reveals it bans customers worth 5-7% of revenue every 9 months — Polymarket · 2026-10-27
- AVERI independently audits Amazon's internal AI safety evals in landmark pilot — Miles_Brundage · 2026-10-27