What script protection does
LOT transforms supported Lua and Luau scripts to make the resulting code harder to read and analyze. It is an added layer of protection, not a way to make distributed code secret.
What it cannot do
Code that runs on a user's device can be inspected, modified, or observed while it runs. Obfuscation cannot guarantee that a determined person will be unable to understand or reproduce its behavior.
Test each build in its target environment before release. Keep important decisions and sensitive data on a server you control.
Keep credentials and authority server-side
Do not include secrets in client scripts
Never embed API keys, database credentials, private signing keys, or the final decision for access and licensing in a Lua script distributed to users. Have a trusted server make sensitive authorization decisions.
Related documentation
See the API reference for build requests and the macro reference for supported script annotations.