CodePen 2.0 Sends All Your Code to Servers

CodePen 2.0 started to create a serious privacy concern in the web development community. According to the findings shared on Hacker News, the entire code you write on the platform is sent to** servers instantly if it is not completed even without being recorded.

A researcher revealed the problem with concrete data by testing this situation:

• Every character written in the editor is transferred to codepen.dev servers within 1-2 seconds
• This data transfer is clearly seen on the Network tab of browser developer tools
• Even unregistered codes are rendered in the preview created
• When tested with a unique marker, even before the marker was recorded, it was detected in the preview HTML

This behavior can be designed for** quick automatic recording** purpose. However, the problem is: if you accidentally paste the API switches, database passwords, or other sensitive information into the editor, these will be saved on CodePen’s servers very first without being deleted.

The developers who have security consciousness know that when using CodePen 2.0 should not write an API key or secret information as a thought editor. The platform should report this behavior and inform users clearly.