Apparently CodePen 2.0 sends data to their servers as you type
40 points - today at 11:22 AM
They send all typed into editor input to codepen.dev almost immediately (you would see in 1-2 sec after you typed your secret that it appears in respective Network/Response tab) even before one saved it. I tested this with a unique marker: after typing it into index.html, CodePen ran a build with "save:false", and the marker then appeared verbatim in the HTML served from the generated "*.codepen.dev preview". Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen
You're gonna be shocked how many input fields do this for various UX features :)
Shopify does this. If you ever go to purchase a product on a Shopify 'site, and enter eg your e-mail address, it'll save it even if you decide to cancel and close the tab. Sometimes you receive spam from companies along the lines of marketing or "we noticed you didn't complete your purchase" type crap. Shit is rly invasive.
embedding-shape
today at 12:02 PM
HotJar and similar services are (were?) popular as well, and those record your mouse pointer movements and clicks as well, then displays that as an overlay over the application, so it's essentially a "screen recording" of your session of the application.
i made my own html playground that is browser only and shares preview via url hash because of these useless shenanigans of codepen, its not as featureful but i mostly use it for sharing single page html files
https://easyanalytica.com/tools/html-playground/
keepo404
today at 11:47 AM
because this is how autocomplete logic works i guess? Frontend cannot guess language and completions for you
maxim-fin
today at 12:19 PM
No autocomplete involved there.
embedding-shape
today at 12:00 PM
Well, except for the cases when you happen to have the entire VM for your language running in the same tab where you program lives, and they both are all JS.
Probably harder, and wouldn't work equally well for everyone, but it would be possible to have "guess language and autocomplete" entirely client-side, especially when it comes to JavaScript of all languages.
Sent to them to render the preview pane. Same as pasting secrets anywhere on a browser.
Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.
maxim-fin
today at 12:20 PM
Yes, that is for rendering
tmpsvc2695f5
today at 12:54 PM
[dead]
cetinsert
today at 12:14 PM
[flagged]
It's obviously very fun; look at all the exclamation points.
Did you make this post under a sock acct just to promote this?