From writable bucket to credential theft