显然，CodePen 2.0 在你输入时会将数据发送到他们的服务器。
他们几乎立即将你在编辑器中输入的所有内容发送到 codepen.dev（你会在输入秘密后 1-2 秒内看到它出现在相应的网络/响应标签中），甚至在你保存之前。我用一个独特的标记进行了测试：在 index.html 中输入后，CodePen 以“save:false”运行了构建，然后该标记原封不动地出现在生成的“*.codepen.dev 预览”中提供的 HTML 中。因此，如果你曾不小心在其中输入了一些秘密，请考虑这些信息已经泄露，即使你没有发布或保存该代码片段。
查看原文
They send all typed into editor input to codepen.dev almost immediately (you would see in 1-2 sec after you typed your secret that it appears in respective Network/Response tab) even before one saved it. I tested this with a unique marker: after typing it into index.html, CodePen ran a build with "save:false", and the marker then appeared verbatim in the HTML served from the generated "*.codepen.dev preview". Thus, if you ever entered some secrets in there by mistake consider them compromized even if you did not publish/save the pen