If you have permanent credentials then you are already in great danger. You should be using temporary credentials with something like Granted.

so stealing temporary credentials are fine, right?