Sharing code snippets safely (what URLs expose)

When you click Share, Code Arena encodes your language and source into a URL-safe token and copies a /s/... link. Opening that link restores the editor with the same code.

There is no private vault behind the link — the payload travels in the URL itself (within size limits). That design is simple and portable, but it means the link is the secret.

Browser history, chat apps, email gateways, link unfurlers, and analytics tools can retain URLs. A “private” Slack DM is still a copy on someone else’s device. Screenshots of the address bar happen.

If a token is long, people paste it into documents that get synced forever. Design your demos so that accidental permanence is boring, not catastrophic.

Never paste API keys, passwords, session cookies, private keys, customer PII, or internal hostnames into a playground and then share the link. Rotate anything that might already have leaked.

• Use fake credentials in demos (example.com, test_key_123)
• Redact customer data and production IDs
• Prefer screenshots if the code is sensitive but the idea is not
• Strip .env contents before you paste “just the bug”

Ask a friend to look at a failing snippet. Send a teacher a homework example. Bookmark a tiny experiment for yourself on a trusted device. Attach a link in a bug report when the code is already public-safe.

For team incidents involving real secrets, use your company’s private gist/snippet tools with access control — not a URL-encoded playground link.

Read the file top to bottom once as if you were an attacker skimming for tokens. Search for Bearer, sk-, apiKey, password, and @gmail.com-style strings. Delete sample data that looks too real.

If the snippet is large, ask whether a smaller reproduction would teach the same point. Smaller links are easier to review and less likely to hide a secret in plain sight.