Roblox script security checklist

Source handling

• Source lives in the dashboard, not in buyer DMs
• No Discord webhooks, bot tokens, or Stripe secrets in Lua
• Protect on save and confirm the cached build is what the loader serves

Loader

• Public snippet is the KeyForge loader, not the project source
• Buyers know they must keep the key line
• You did not upload the loadstring contents as a static file that can go stale

Keys and access

• Duration matches what you sold
• HWID bind enabled if you need one-device keys
• You know how to revoke from the dashboard and Discord
• Ad-link grants use one-time claims if you monetize that way

Game lock

• PlaceId / game routing set when the script should not be a universal hub

Discord

• Panels or slash commands issue keys instead of staff pasting serials in public channels
• HWID reset is a staff action, not a public button

Leak response

• Revoke first
• Re-protect if a dump is everywhere
• Do not promise the next build is uncrackable

Walkthrough: protect a Roblox script.