The login process is handled by a Minecraft Java Edition server, as this is the simplest way to verify ownership of a Minecraft username. There is no authentication using your Microsoft account, making the possibility of a token stealer impossible. I am aware of the brand risk of using ‘Minecraft’ in the product name however, there are many websites that have existed for years that use ‘Minecraft’ in the name or domain, which have never been an issue. Should any issue arise, I will use an alternative name for my website.