Credentials stay in this browser tab (sessionStorage) and are posted with each request to list and presign objects — never written to disk on the server.

Sign-in link embeds your credentials in the URL fragment (after the #). Fragments aren't sent to servers, but anyone with the link gets full access to the bucket — bookmark or share carefully.