Apparently CodePen 2.0 sends data to their servers as you type

They send all typed into editor input to codepen.dev almost immediately (you would see in 1-2 sec after you typed your secret that it appears in respective Network/Response tab) even before one saved it. I tested this with a unique marker: after typing it into index.html, CodePen ran a build with "save:false", and the marker then appeared verbatim in the HTML served from the generated "*.codepen.dev preview". Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen

▲

tvink 2 hours ago | parent | next [-]

You're gonna be shocked how many input fields do this for various UX features :)

▲

nusl an hour ago | parent | next [-]

Shopify does this. If you ever go to purchase a product on a Shopify 'site, and enter eg your e-mail address, it'll save it even if you decide to cancel and close the tab. Sometimes you receive spam from companies along the lines of marketing or "we noticed you didn't complete your purchase" type crap. Shit is rly invasive.

▲

Boss0565 15 minutes ago | parent | next [-]

Have you checked to see if it’s stored in localstorage

	▲	masfuerte 9 minutes ago \| parent [-]
		If they are sending you emails the address is not just in localstorage.

▲

weezing 6 minutes ago | parent | prev [-]

Simplelogin is a godsend for this cancer

▲

maxim-fin 4 minutes ago | parent | prev | next [-]

Yes, but codepen is for frontend devs. And devs are more likely to accidentally leak secrets because, well, they have them

Edit: accidantlay -> accidentally

▲

embedding-shape 2 hours ago | parent | prev [-]

HotJar and similar services are (were?) popular as well, and those record your mouse pointer movements and clicks as well, then displays that as an overlay over the application, so it's essentially a "screen recording" of your session of the application.

▲

nseskin 2 hours ago | parent | prev | next [-]

There’s a detailed discussion of the same issue here https://www.reddit.com/r/webdev/comments/1rj1oac/i_planted_f...

	▲	maxim-fin 6 minutes ago \| parent [-]
		Indeed, it looks like CodePen v1 was sending data to codepen.io, cpwebassets.codepen.io, and cdpn.io. Now v2 sends to codepen.dev

▲

midnitewarrior 24 minutes ago | parent | prev | next [-]

Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time.

I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.

	▲	VoidWhisperer 3 minutes ago \| parent [-]
		Something like this would've been incredibly useful at my previous job - we often had to put together how a user triggered an issue using a combination of logs and analytics to track what actions they took..

▲

cph123 2 hours ago | parent | prev | next [-]

For basic previewing I like to use https://htmledit.squarefree.com which has been online for years and does it all client side.

▲

pdyc 2 hours ago | parent | prev | next [-]

i made my own html playground that is browser only and shares preview via url hash because of these useless shenanigans of codepen, its not as featureful but i mostly use it for sharing single page html files

https://easyanalytica.com/tools/html-playground/

▲

bashy 2 hours ago | parent | prev | next [-]

Sent to them to render the preview pane. Same as pasting secrets anywhere on a browser.

Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.

	▲	maxim-fin an hour ago \| parent [-]
		Yes, that is for rendering

▲

keepo404 2 hours ago | parent | prev [-]

because this is how autocomplete logic works i guess? Frontend cannot guess language and completions for you

▲

maxim-fin an hour ago | parent | next [-]

No autocomplete involved there.

▲

embedding-shape 2 hours ago | parent | prev [-]

Well, except for the cases when you happen to have the entire VM for your language running in the same tab where you program lives, and they both are all JS.

Probably harder, and wouldn't work equally well for everyone, but it would be possible to have "guess language and autocomplete" entirely client-side, especially when it comes to JavaScript of all languages.

▲

odo1242 25 minutes ago | parent [-]

It seems like the main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side and your webpage might be CPU/memory limited

	▲	embedding-shape 20 minutes ago \| parent [-]
		> main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side Not sure what "model weights" you're talking about, but yes, that is the trade-off. Although complete autocomplete data for the entirely of the JavaScript APIs would be what, in an efficient format, easily below 1MB at least.