The first thing I check on services which advertise as S3-compatible is permissions. As usual - no permissions, no ACLs. So practically it looks like anyone with an access key can wipe out everything you store with them.