https://developers.yubico.com/OTP/OTPs_Explained.html

Turns out, these codes are still valid until you login anywhere with them :neofox_think_woozy:

So if you post them online, you can invalidate them by using https://demo.yubico.com/otp/verify for example.