CodePen 2.0 sends editor input to its servers as you type, exposing unsaved secrets
maxim-fin · hn · 2026-09-07
An HN user found that CodePen 2.0 transmits all editor keystrokes to codepen.dev within 1-2 seconds of typing — even before the pen is saved or published.
The test used a unique marker string typed into index.html: CodePen ran a build with save:false, and the marker appeared verbatim in the HTML served from the generated .codepen.dev preview, visible in the Network/Response tab.
Bottom line: any secrets accidentally pasted into the editor should be considered compromised even if never saved. Users are advised to rotate keys.
More from Safety
- Study: AI reviewing AI misses most reward hacking; best models miss 25%+ of hacks — ronbodkin · 2026-10-26
- Fangcun AI, China's first independent frontier AI safety lab, launches with DeepSeek eval report — JacquesThibs · 2026-10-26
- ESR on the Bugpocalypse: locking down frontier models only hands the game to Chinese open weights — colinmcnamara · 2026-10-26
- OpenCode breach exposed AI API keys of 1.4% of Console users — thione · 2026-10-26
- DHS orders DeepSeek products removed from US civilian agency systems — thione · 2026-10-26
- One hacker breached 100+ company websites using AI, scope unknown — thione · 2026-10-26