LuaServer-enforced access
The auth endpoint checks the script, owner account, license, expiration, ban, and HWID before issuing a ticket, and re-checks before releasing source. Keyless scripts intentionally skip the license check. Database failures fail closed.
Public bootstrap, private source
The universal Luraph bootstrap holds the client auth logic and is public so clients can authenticate. Browser navigation to a file endpoint returns a real 403, but request headers are not credentials — private source is released only by the auth checks.
Single-use delivery
Tickets expire after two minutes, are bound to the exact request values, and are consumed atomically in shared database storage (hashes only). A ticket is not bound to an IP, so the two phases can cross proxies or replicas.
Integrity & payload encoding
The server verifies a pinned SHA-256 of the bootstrap before serving it; the loader verifies the decoded source digest before running. The x1 encoding is reversible obfuscation, not encryption against the recipient. Use HTTPS for transport.
Client-side limits
Anyone who can execute code can inspect it; obfuscation raises the cost, it does not make recovery impossible. Revoking a key or disabling a script stops future downloads, not copies already delivered. Client-supplied HWIDs can be spoofed.
Database boundaries
The dashboard uses Supabase sessions and row-level security. Keep the service-role key only on the server; never put it in the bootstrap or config.js. Ticket storage is not exposed to dashboard users.