Comment by Zombieball

> and the bucket itself had no protection against outside access with a compromised key

Any advice on how to safeguard against this?