A recent Hacker News discussion revealed that CodePen 2.0 transmits user data to its servers in real-time as code is typed. While the platform claims this functionality supports autosave and preview rendering, users have raised significant privacy concerns. Commenters noted that any secrets, passwords, or API keys entered into the editor should be considered compromised once transmitted.

The platform does not explicitly disclose this data collection in its main Terms of Service or Privacy Policy, only mentioning it within Builds documentation. Historically, CodePen v1 sent data to codepen.io and cpwebassets.codepen.io, while v2 routes information through codepen.dev. Comparisons were drawn to session recording services like FullStory and Hotjar, which capture mouse movements and keystrokes.

Although the autosave feature prevents data loss during crashes, the lack of transparency regarding data transmission has sparked debate within the developer community about the trade-off between convenience and security.