what is zenfuscator?
it compiles your lua to bytecode and runs it on a custom virtual machine. your source code never ships; there is no lua source in the output to decompile.
what does it actually protect against?
it defeats public lua decompilers, string-dump tools, casual reading, and quick tampering (crc integrity seal plus format checks). a determined analyst who scripts against the documented format can still recover constants: everything runs client-side, and no client-side scheme stops that.
why is there no layer count anymore?
earlier builds stacked xor rounds and counted each as a layer. more rounds of a known encoding is security theater, so l10 dropped them and ships a versioned format with an attack-regression test that measures what a deobfuscator actually recovers.
where should secrets live?
on a server you control. anything embedded in lua that reaches a user's device can be extracted: api secrets, license checks and sensitive logic all belong server-side.
is the api key real security?
no. it gates the page and the check runs in the browser, so it is a speed bump, not real authorization.
does my code get uploaded anywhere?
no. everything runs in your browser, nothing is sent to a server.
what lua versions does the output run on?
lua 5.1 and luau. the output is plain lua source with no external dependencies.
will it slow my code down?
yes, the vm adds overhead. most scripts won't notice; hot loops will feel it the most.