CodePen 2.0 sends your keystrokes to its servers before you save
Apparently CodePen 2.0 sends data to their servers as you type
A Hacker News user reports that CodePen 2.0 transmits editor input to its servers almost immediately, even before saving. They tested by typing a unique marker into index.html, and it appeared in the generated preview HTML without saving. This raises privacy concerns: any secrets typed by mistake may be compromised even if the pen is never published.
Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen.
- giancarlostoro
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
- tvink
You're gonna be shocked how many input fields do this for various UX features :)
- maxim-fin
CodePen does not disclose this in neither ToS nor in Privacy Policy, only in Builds documentation they say: “As you work on CodePen, your Pens are constantly running through the CodePen Compiler”
- nseskin
There’s a detailed discussion of the same issue here https://www.reddit.com/r/webdev/comments/1rj1oac/i_planted_f...
- midnitewarrior
Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time.
I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.