A token-protected HLS stream that still opens in VLC is one of the most common stream-security surprises in the field. Authentication passed, the stream looked locked down, and yet a copied manifest URL plays in a desktop player with no further check. The same gap explains why an authorized viewer can forward a working link…