developers.yubico.com/OTP/OTPs

Turns out, these codes are still valid until you login anywhere with them :neofox_think_woozy:

So if you post them online, you can invalidate them by using demo.yubico.com/otp/verify for example.