so stealing temporary credentials are fine, right?

Yeah just delay them by ~15 minutes :)