The key problem is thinking anything the client does is secure, or even worse, that it may be trusted. A developer that hasn't grasped this very simple fact will inevitably not only screw up the client side (i.e. exposing AWS credentials), but also the server side.