CREDENTIALS
Secrets do not live in profile JSON.
Access keys are stored in macOS Keychain items under opaque connection identifiers. Configuration metadata never contains the secret access key.
SECURITY
The credentials stay in the Keychain. The workflow stays on your Mac.
S3Workbench is deliberately transparent about where credentials, signatures and object data are handled.
TRANSPORT
System trust is the default.
HTTPS and system TLS verification are the normal path. A custom CA can be scoped to one connection; disabling TLS verification is not supported.
SURFACE
Errors are redacted before they surface.
Authorization headers, credentials, signatures, session tokens and presigned query values are removed from surfaced errors and logs.