This is exactly the scenario I pictured

If you are pasting secrets into codepen you are probably really terrible at all other basic security practices.

It's also a foolish thing to do. Any time anyone types anything into anywhere on any webpage, that data is as good as gone, it's out there. Back in the 90's I experimented with per-character logging on all form input boxes, just because I could. That's still possible today.