what is zenfuscator?
it compiles your lua to bytecode and runs it on a custom virtual machine. your source code never ships; there is no lua source in the output to decompile.
what does it actually protect against?
it defeats public lua decompilers, string-dump tools, casual reading, and quick tampering (crc integrity seal plus format checks). a determined analyst who scripts against the documented format can still recover constants: everything runs client-side, and no client-side scheme stops that.
why is there no layer count anymore?
earlier builds stacked xor rounds and counted each as a layer. more rounds of a known encoding is security theater, so l10 dropped them and ships a versioned format with an attack-regression test that measures what a deobfuscator actually recovers.
where should secrets live?
on a server you control. anything embedded in lua that reaches a user's device can be extracted: api secrets, license checks and sensitive logic all belong server-side.
how does the api key check work now?
server-side. the key is sent over https to the signing server, which checks it and signs your payload; the page itself never holds the secret and the check can no longer be patched out in the browser. it still is not drm: the obfuscated output is self-contained once created.
what does a signed build mean?
every payload is signed with a private key that only lives on the signing server. the runtime verifies the signature against an embedded public key before running anything, so edited or corrupted outputs refuse to run. that detects tampering; it does not stop someone from reading the logic.
does my code get uploaded anywhere?
no. everything runs in your browser, nothing is sent to a server.
what lua versions does the output run on?
lua 5.1 and luau. the output is plain lua source with no external dependencies.
will it slow my code down?
yes, the vm adds overhead. most scripts won't notice; hot loops will feel it the most.