The secret key isn't stored in the client (I looked :P), only the AWSAccessKeyId, policy, and signature are. The policy dictates what can be stored in the buck

The secret key isn't stored in the client (I looked :P), only the AWSAccessKeyId, policy, and signature are. The policy dictates what can be stored in the bucket, and the signature validates the policy so folks don't tamper with it.