Your pass/seed phrase or your password?
And no single confirmation on your Ledger device needed?
My passphrase. Not a single one or a mandatory connection with the hardware device.
Okay, that is quite scary. Although alarmbells should always go off when you actively start entering your passphrase. That should never be neccesary to enter for claiming an NFT I would think. It's probably 70% your fault and 30% Ledger.