CodePen 2.0 sends editor input to servers in real time

A security researcher has demonstrated that CodePen transmits any text entered into its editor to the platform’s servers in near‑real time, exposing the content before a user explicitly saves the pen. By typing a distinctive marker into the index.html file, the researcher observed the data appear within one to two seconds in the browser’s Network/Response tab, even though the pen was configured with a “save:false” build. The marker subsequently showed up verbatim in the HTML served from the generated “*.codepen.dev” preview URL, confirming that the platform processes and stores the input immediately.

The finding, discussed on Hacker News (item 49596976) and garnering 23 points and nine comments, warns users that any confidential information entered inadvertently into CodePen’s editor may be compromised regardless of whether the pen is published or saved. Developers are advised to treat the editor as a public input field and avoid typing secrets such as API keys or passwords, as the data is effectively transmitted and cached on CodePen’s servers the moment it is entered.