SCRULI // DOCS
Scruli Security
#Why Scruli
Scruli is a full protection layer for Roblox scripts. You upload your build, Scruli hardens it, locks it behind a key bound to one machine, serves it through your own loader, and tells you exactly who runs it. If someone tries to leak or resell it, you see it and you cut them off.
Real obfuscation
Multi-pass bytecode virtualization + string encryption, built for Luau. Four strength tiers, one click on upload.
HWID-locked keys
Every key binds to a single machine. Paid scripts need key + HWID — sharing a key gets the sharer nowhere.
Live monitoring
A webhook fires on every execution — who ran it, how many times, from where. Nothing runs without you knowing.
Keysharing alarms
Scruli fingerprints each run. When one key jumps machines or regions, it pings you automatically.
Discord bot
Buyers redeem, reset HWID and grab their script from a panel. You gen keys and blacklist abusers with a command.
Fair pricing
$5 for 20 days. No lock-in, no per-execution tax. Earn free time by inviting people to the community.
The short version: other tools stop at "obfuscate and pray." Scruli obfuscates, gates, and watches — so a leak is something you catch and punish, not something you find out about weeks later.
#Quickstart
From zero to a protected script in five steps:
- Get a key. Grab a Scruli Security license on the home page ($5 / 20 days). This is your owner key — it unlocks the dashboard.
- Open the dashboard. Paste your key at /dashboard. Create a project (a folder for your scripts).
- Upload a script. Pick a
.lua/.luaufile, choose Free or Paid, leave Obfuscate on upload checked, pick a strength, upload. - Copy the loader. Each script gives you a one-line loader. Ship that line to your users, not the source.
- Hand out keys. For paid scripts, generate customer keys (dashboard or the
/genkeybot command) and sell/give them out.
Tip: your first upload can take up to a minute while the protection engine spins up. After that it's fast.
#Projects & scripts
Everything lives under projects. A project is just a container to organize your scripts. You can keep up to 8 scripts total across all your projects. Each script is Free (runs for anyone with the loader link) or Paid (needs a valid key + HWID).
Per script you control:
- Free / Paid — whether a key is required.
- Heartbeat — count live users in real time (analytics only, nothing is stored from the machine).
- Webhook — a Discord webhook that logs every execution (see below).
- Obfuscation strength — set at upload.
There is no public raw copy of a paid script anywhere. It only ever leaves our servers already protected, gated behind the loader.
#Obfuscation
When "Obfuscate on upload" is on, Scruli rewrites your script into a hardened, self-contained build before it's ever stored. Strings are encrypted, numbers and control flow are transformed, and the whole thing runs inside a custom bytecode virtual machine — the readable source never leaves your machine.
Four tiers, so you balance protection against runtime cost:
| Tier | What it does | Best for |
|---|---|---|
| Weak | Light virtualization, fast | Small utilities, low overhead |
| Medium | VM + string encryption | Default — most scripts |
| Strong | Double VM layer | Scripts you really don't want copied |
| Max | Heaviest hardened stack | Small / server-side logic |
Heads up on FPS: Strong and Max add real runtime weight. On big scripts with hot loops (ESP, aimbot, per-frame work) that can cost frames. For those, Medium is the sweet spot. Keep Max for small or sensitive scripts.
Already obfuscated your build elsewhere? Just untick the box and Scruli will gate and deliver it as-is.
#The loader
Instead of pasting your source, your users run a tiny loader. It talks to Scruli, checks the key + HWID, and streams the protected build down. Free scripts skip the key.
Paid script
Free script
The key travels in getgenv().script_key, never in the URL. The dashboard gives you the exact loader line for each script — copy it straight from there.
#Keys & HWID
Paid scripts unlock with a customer key. On first run the key binds to that machine's hardware id (HWID). After that, the key only works on that one machine.
- Generate keys — from the dashboard, or
/genkeyin Discord once you've linked your owner key. - Expiry — keys can be time-limited; expired keys stop unlocking.
- Reset HWID — a user who changed PC can reset their bind once (dashboard or
/resethwid). Every reset is recorded.
Because a key is welded to one machine, handing it to a friend does nothing for them — and if they try, keysharing detection catches it.
#Hosted compute
The strongest protection is code that never reaches the client — it can't be dumped because it was never there. Scruli hosts that for you: secret values and feature gating live on our server, and your script asks for them at runtime. No server of your own to run.
Two things are exposed from the loader, no setup beyond the dashboard:
Config vault — scruli.config()
A secret JSON blob you edit in the dashboard (script settings → Hosted compute). Put tunables, farm targets, private strings — anything you'd rather not ship in plaintext. Change it any time without re-releasing the script.
Feature gate — scruli.gate()
Returns which features the current user unlocks, decided on the server from rules you set. The client never sees the logic — only the yes/no.
Rules are a small JSON list. Each rule maps a feature to the tiers allowed to use it:
"tiers" accepts "*" (anyone with access), "paid" / "free", or a specific key tier. In the example, everyone gets ESP, but only paid keys get aimbot — and a free user can't flip that, because the decision was made server-side.
Own backend — scruli.remote(payload)
Already run your own server? Point the script at it (settings → Server logic) and Scruli forwards the call, gated by key + HWID, with your shared secret. Your function runs on your machine; only its result comes back.
Honest limit: a value or answer that comes back to the client can be read once it arrives — hosted compute protects the logic and secrets that stay on the server, not whatever you then do with the result on the client. Use it for the parts worth hiding: gating decisions, private constants, the actual algorithm. Call it on load, not inside a per-frame loop (each call is a network round-trip).
#Checkpoint / get-key
Turn a free script into income and reach. Instead of running instantly, users pass through a branded get-key page — optionally behind your money link (Linkvertise, LootLabs, Work.ink) — and walk away with a short-lived key locked to their machine.
Enable it per free script in settings → Checkpoint:
- Reward site — pick Linkvertise / LootLabs / Work.ink (its logo shows on the get-key page), or "Other".
- Money link — paste your ad-link URL. Set that link's destination to your return URL (shown in settings):
https://scruli-security.uk/getkey?s=SCRIPT_ID&done=1. Leave the link blank for a plain timed gate with no ads. - Key duration — how long the issued key lasts (hours).
Ship users the get-key link instead of the raw loader:
Flow: user opens the page → completes your link → comes back and gets a key → pastes it into the loader. The key is HWID-locked on first run and expires after your set duration, so a leaked key is worthless on another machine and dies on its own.
Robust by design: the session survives the ad round-trip even when it hands off to a different browser (Discord in-app → system browser), and a slow multi-step wall won't expire mid-flow. If a session is ever lost, the page just restarts itself — no dead ends.
Your dashboard profile shows how many keys were completed and how many of those actually ran a script — so you see the reach the checkpoint is buying you.
#Execution webhooks
Set a Discord webhook on any script (settings → Webhook) and Scruli posts a log every time the script runs. You get a live feed of usage without lifting a finger.
A paid-script log includes:
- the buyer's Discord (when their key is linked)
- which script ran
- how many times that key/machine has run it
- the machine's HWID
- rough location (country / region)
Free-script logs skip the identity and just show run count, HWID and location. It's the fastest way to spot a script blowing up — or being abused.
#Keysharing detection
Every run is fingerprinted. If a key that always ran from one place suddenly appears from a different machine or region without a legitimate HWID reset, Scruli treats it as sharing and fires a loud alert (an @here ping) into your webhook — with the key and HWID attached.
Why it matters: HWID locking already blocks a shared key from working elsewhere. Detection is the second layer — it tells you who is trying, so you can blacklist them before it becomes a habit.
#Blacklist
Caught someone? Ban them in one move. A blacklisted HWID or key is refused by the loader instantly — the script simply won't run for them anymore.
- Dashboard — settings → paste an HWID or a key → Blacklist.
- Discord —
/blacklist <hwid or key>as the script owner.
Blacklisting a key bans that license; blacklisting an HWID bans that machine across your scripts.
#Discord bot
The Scruli bot lets you run the whole thing from Discord and gives your buyers a self-serve panel. Add it to your server, then:
/link— link your owner key so the bot knows it's you./genkey— generate a customer key for one of your paid scripts./panel— post a buyer Control Panel: redeem key, reset HWID, get script, get role./status— check a key (bind, expiry)./resethwid— reset a machine bind./blacklist— ban an HWID or key./checkinvite— see your referral progress.
For buyers: drop a /panel in your server and they redeem, reset and grab their script with buttons — no tickets, no manual handoff.
#Referral rewards
Invite people to the community and earn free protection. Bring 5 valid invites and the bot hands you a free 10-day Scruli Security key.
"Valid" means real: fake accounts, alts and brand-new accounts don't count — invited accounts must be at least 30 days old. Track your progress any time with /checkinvite.
#Security model
Let's be straight, because honesty is worth more than hype: any code that reaches a player's machine can, in theory, be pulled apart by a determined expert. No client-side protection anywhere is truly un-dumpable — anyone who claims otherwise is selling you something.
What Scruli does is make it not worth the effort, and make abuse visible and punishable:
- Hardening turns a copy-paste job into hours or days of manual reverse engineering — enough that the overwhelming majority give up.
- Sensitive logic can run server-side, so the real algorithm never ships to the client at all — it can't be dumped because it was never there.
- Monitoring means even a successful abuser is caught: you see the execution, the HWID, the location, the sharing — and you blacklist them.
That's defense in depth: hard to crack, expensive to share, and impossible to do quietly.
#FAQ
Do I have to obfuscate with Scruli?
No. Bring an already-protected build and untick the box — Scruli will gate and deliver it. But letting Scruli do it is one click and needs zero setup.
Will protection lag my script?
Medium is light enough for most scripts. Strong/Max add weight — for large scripts with per-frame loops, stick to Medium. See Obfuscation.
What happens if a buyer changes PC?
They reset their HWID once — from the dashboard or /resethwid — and the key rebinds to the new machine. Resets are logged.
How do I stop a leaker?
Blacklist their key or HWID. The loader refuses them immediately. See Blacklist.
Still stuck? Ask in the Discord — we answer fast.