Treat the administration URL as a password
Anyone who knows the administration access can change the team without discovering a username or passing another form. Keep it out of captured address bars, visible bookmarks, on-stream history and screenshots sent to chat.
The viewing URL has a different job: it displays state and belongs in OBS. Separating the two prevents edit capability from reaching people who only need the result.
Keep administration outside the captured environment
Open administration in a profile or window that is never captured. Prefer game or window capture over full desktop capture. Rehearse the exact edit flow from a safe scene and check what appears when switching windows.
Keep two tested ways to recover the run
Store the private URL in a password manager or non-public bookmark and download the access file after setup. The file carries recovery capability and should not be published. Open it once in a private window before the first stream; an untested backup is only a hope.
Act if the link appears on screen
- Switch immediately to a safe scene.
- Stop distributing the recording if possible.
- Check whether access can be regenerated or revoked.
- Review team state for unexpected changes.
- Remove the segment before publishing the VOD.
Do not assume nobody read the address. Clips and screenshots can preserve it after the broadcast.
Use a sixty-second pre-stream routine
Verify that OBS uses viewing access, administration is outside capture, recovery is available and the emergency scene works. Repeating these four checks costs less than rebuilding a compromised run.