3 ms·
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
by giancarlostoro 1mo ago
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
- maxim-fin 1mo agoYes, that is for autosave and for rendering Edit: The point is that any secrets typed/pasted in there should be considered compromized
- deleted 1mo ago[deleted]
- giancarlostoro 1mo agoI don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?
- traviswingo 1mo agoCopy -> paste -> redact secrets That flow would be considered unsafe, and probably common.
- maxim-fin 1mo agoThis is exactly the scenario I pictured
- giancarlostoro 1mo agoIf you are pasting secrets into codepen you are probably really terrible at all other basic security practices.
- leptons 1mo agoIt's also a foolish thing to do. Any time anyone types anything into anywhere on any webpage, that data is as good as gone, it's out there. Back in the 90's I experimented with per-character logging on all form input boxes, just because I could. That's still possible today.