I adressed the security part at the end of the answer, please finish reading until the end.
"The beauty of this solution is that the application does not receive your key. It just receives an authorization (provided by SteemConnect) at the blockchain level. This authorization will allow him to perform the actions you have authorized, neither more nor less."
It does receive the key. You input them right into the website.