HN Explorer

Apparently CodePen 2.0 sends data to their servers as you type

2 points by maxim-fin ↗ HN
They send all typed into editor input to codepen.dev almost immediately (you would see in 1-2 sec after you typed your secret that it appears in respective Network/Response tab) even before one saved it. I tested this with a unique marker: after typing it into index.html, CodePen ran a build with "save:false", and the marker then appeared verbatim in the HTML served from the generated "*.codepen.dev preview". Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen

60 comments

[ 2.2 ms ] story [ 10.5 ms ] thread
keepo404
because this is how autocomplete logic works i guess? Frontend cannot guess language and completions for you
embedding-shape
Well, except for the cases when you happen to have the entire VM for your language running in the same tab where you program lives, and they both are all JS.

Probably harder, and wouldn't work equally well for everyone, but it would be possible to have "guess language and autocomplete" entirely client-side, especially when it comes to JavaScript of all languages.

odo1242
It seems like the main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side and your webpage might be CPU/memory limited
embedding-shape
> main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side

Not sure what "model weights" you're talking about, but yes, that is the trade-off. Although complete autocomplete data for the entirely of the JavaScript APIs would be what, in an efficient format, easily below 1MB at least.

mkgiga
Code editor autocomplete doesn't use ai — search up LSP
giancarlostoro
Yeah I remember CodePen refreshing for me plenty of times.
mkgiga
yes it can. all you need are some tokenizers for the languages you want to guess and once you derived the language, a few lookup tables to store variable name references in :)
bashy
Sent to them to render the preview pane. Same as pasting secrets anywhere on a browser.

Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.

tvink
You're gonna be shocked how many input fields do this for various UX features :)
nusl
Shopify does this. If you ever go to purchase a product on a Shopify 'site, and enter eg your e-mail address, it'll save it even if you decide to cancel and close the tab. Sometimes you receive spam from companies along the lines of marketing or "we noticed you didn't complete your purchase" type crap. Shit is rly invasive.
Boss0565
Have you checked to see if it’s stored in localstorage
masfuerte
If they are sending you emails the address is not just in localstorage.
weezing
Simplelogin is a godsend for this cancer
davidmurdoch
They can only send the marketing emails if you have the "send me marketing emails" checkbox checked when you type in your email address. Dark pattern, yeah.
xingped
That has never stopped companies from spamming me with marketing even when I didn't agree or even explicitly disagreed (unchecked). Not a single company has been or ever will be held accountable so they just keep doing it.
davidmurdoch
Shopify 's "abandoned cart" emails are legally considered transactional emails, not marketing, which is probably what you're getting. It's a feature built in to Shopify. If the email isn't related to your abandoned cart contents, you can report it to Shopify. Shopify will investigate reports of abuse and eventually will terminate a store account for blatant abuse.
aveao
Isn't the email at the top of the form and the marketing checkbox at the bottom? It's an awful dark pattern and makes me want to not use any company that uses shopify.

They require your full address to show you shipping prices as well (vs just letting you estimate with country and postal code alone), so I have to punch in a ton of details before I nope out at awful shipping costs, and I end up with these emails.

davidmurdoch
No. For Shopify's checkout, it's directly beneath the email input.

You're probably getting the "abandon cart" emails, which is legally considered a "transactional email", and doesn't require consent.

nusl
No, I've received it just from entering my e-mail and nothing else. So many companies don't care, or don't know.

Either way, if I enter my e-mail, decide "nah" and quit, that should be that. It shouldn't be sending my details in the background

maxim-fin
Yes, but codepen is for frontend devs. And devs are more likely to accidentally leak secrets because, well, they have them

Edit: accidantlay -> accidentally

pdyc
i made my own html playground that is browser only and shares preview via url hash because of these useless shenanigans of codepen, its not as featureful but i mostly use it for sharing single page html files

https://easyanalytica.com/tools/html-playground/

[deleted]
(comment deleted)
cetinsert
I built https://RTCode.io to escape their sluggish hell! CodePen has no place in today's world.

- everything is local until you deploy

- with first-class support for

  - connect your AI to playground

    - version-controlled deployments

    - full playground control

    - output viewport size, zoom, color scheme control

    - output eval for rapid development

    - output live capture and image-cropped element/region pins

    - output live stream picture-in-picture to watch your agents work

  - state preserving 2-way IO sync

  - multi-level open shadow root IO sync

  - service/edge workers in the playground (develop full-stack apps in one place)

    - example: https://post.rt.ht

    - example: https://kv.rt.ht/fs

    - examples: https://new.rt.ht
- enterprise-class global network: https://RTEdge.net

Too many features to list them all here!

I don't even code in https://RTCode.io myself, I connect Codex/Claude and let them build me full-stack apps live and deploy their work with commit messages!

For more info: https://elefunc.com/#code

dakolli
Did you make this post under a sock acct just to promote this?
sejje
Sock account from 2013?
[deleted]
(comment deleted)
sejje
It's obviously very fun; look at all the exclamation points.
midnitewarrior
Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time.

I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.

VoidWhisperer
Something like this would've been incredibly useful at my previous job - we often had to put together how a user triggered an issue using a combination of logs and analytics to track what actions they took..
giancarlostoro
Elastic has something like this too, as does Splunk iirc. Idk how all three compare I just know they can track DOM events type of stuff and recreate a flow video.
ramesh31
>"Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time."

After having worked with many of these tools I try to explain to lay people all the time that everything you do on your phone, from the moment you unlock it, is tracked and logged somewhere by someone. Every touch, every swipe, every website, every app, every form whether you submit it or not. They generally look at me like I'm crazy. People simply have no idea the level of tracking going on.

maxim-fin
CodePen does not disclose this in neither ToS nor in Privacy Policy, only in Builds documentation they say: “As you work on CodePen, your Pens are constantly running through the CodePen Compiler”
kypro
This is so it can restore any unsaved changes.

I take no opinion on whether this is good or bad, but I can see how from a UX perspective it's nice not to lose 10 minutes of work because your browser crashes or something.

giancarlostoro
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
maxim-fin
Yes, that is for autosave and for rendering

Edit: The point is that any secrets typed/pasted in there should be considered compromized

[deleted]
(comment deleted)
giancarlostoro
I don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?
quietraster
the 'it's just autosave' defense in the comments is interesting. is keystroke-level granularity actually needed for that though?
aveao
Reads to me like it's debounced to a few seconds after you stopped typing.
mkgiga
I think what's more interesting is if privacy is the concern, why does the timing matter? The same data is getting saved either way.

Actually never mind, you aren't sending them private information anyway so it's not a privacy concern in the first place.

dbushell
I'm looking forward to the Gamers Nexus exposé
millerm
Reddit does this. Every keystroke you type into a comment box is sent back to them. So, that means even if you decided to cancel posting something, they still receive what you wrote. I have been known to write responses that were harsh and angry, and I simply don't send. Sometimes it's therapy for me to think through something while typing whatever is in my head. Then I go back and edit once I have have thought it through. I don't want that info sent back. So, I tend to not involve myself with much online anymore. I don't want to expose myself to the thought police.

I find the browser the most unsafe piece of tech deployed.

mkgiga
if you paste secrets in any website you should be fired immediately
spartanatreyu
Well duh, this is how codepen works!

Try this:

1. Open one of your codepens

2. Now open the same codepen in a different window so you have two open at the same time

3. Now type in one window

4. Watch it s̶e̶n̶d̶ ̶y̶o̶u̶r̶ ̶c̶h̶a̶n̶g̶e̶ ̶t̶o̶ ̶t̶h̶e̶ ̶s̶e̶r̶v̶e̶r̶ ̶t̶o̶ magically update all other clients

eitri
Autosave doesn't necessarily require the server though. localStorage can provide keystroke level saving on the client and survive a crash just fine. So I'm not sure that "its just autosave" fully explains why every keystroke needs to be sent to the server.