Apparently CodePen 2.0 sends data to their servers as you type

CodePen’s new version streams every keystroke from the editor to its servers, triggering an immediate build even when the user hasn’t saved the pen. A test using a unique marker showed the marker appearing verbatim in the generated *.codepen.dev preview, meaning any typed secrets are exposed instantly.