Credentials in macOS Keychain.
Access keys are stored in macOS Keychain items under opaque connection identifiers. Configuration metadata never contains the secret access key.
Credentials and security.
S3Workbench is deliberately transparent about where credentials, signatures and object data are handled.
System trust is the default.
HTTPS and system TLS verification are the normal path. A custom CA can be scoped to one connection; disabling TLS verification is not supported.
Errors are redacted before they surface.
Authorization headers, credentials, signatures, session tokens and presigned query values are removed from surfaced errors and logs.