Your Roblox Script Got Leaked. Here's What to Do Next

A step-by-step plan for when your Roblox script is leaked or cracked: find out what leaked, cut off the bad keys and devices, ship a fresh build and stop it happening again.

It happens to almost every creator eventually. Someone posts your script for free, or a key gets shared in a big server, or a "cracked" version shows up somewhere. The first hour matters, so here's a plan.

Step 1: Work out what actually leaked

"My script leaked" can mean very different things, and each needs a different response.

  • A key leaked. Someone posted a working key. Your script is fine. The key is the problem.
  • The loader leaked. Someone is sharing your loadstring. That's normal and harmless if your server checks keys.
  • The source leaked. Someone has posted readable code that's clearly yours. This is the serious one.
  • A modified version is going around. Someone took your script, removed the key check and reposted it.

Before doing anything, look at what's been posted. You'll waste time if you rebuild everything because of a single shared key.

Step 2: Cut off the keys and devices involved

If a key leaked, or a cracked copy still phones home, act on the key and the devices behind it.

  • Revoke the leaked key so it stops working everywhere.
  • Look at which devices used it. A key that suddenly shows up on many different hardware IDs is a key that's being shared.
  • Ban by hardware ID where it makes sense. A HWID ban follows the device, not the account, so a new Roblox account doesn't get around it. Our HWID ban explainer covers how that works.

If your key system can kick players who are running the script right now, use it. A ban that only applies next time they launch gives them hours with your script.

Step 3: Check your execution numbers

Your stats will usually tell you how bad it is.

  • A sudden spike in executions with no new release usually means a key or copy is spreading.
  • Lots of new devices on one key is the clearest sign of sharing.
  • Players from a single server or group can tell you where it was posted.

This is also how you find out about leaks before someone tells you. Creators who watch their numbers often catch a leaked key within the hour.

Step 4: Ship a fresh build

If the source leaked, assume the old build is burned.

  • Re-obfuscate and publish a new version. A fresh build changes the protected output, so tools or patches written against the old copy are far less likely to keep working.
  • Change anything secret that was in the script. Webhook URLs, API keys or endpoints in a leaked copy should be treated as public. Rotate them.
  • Keep the old version handy. If the new build has a bug, being able to roll back quickly saves you a second bad day.

Step 5: Tell your community

A short message in your Discord goes a long way:

  • That you're aware of the leak.
  • That leaked copies may stop working or may have been tampered with.
  • Where to get the real script.

That last point matters. Reposted copies of leaked scripts sometimes have something added. Pointing your players back to the official loader protects them as well as you.

Step 6: Close the gap that let it happen

Once things are calm, look at how it got out.

  • Was the full script in the loader? If readable source was ever sent to the player, it was only a matter of time. The real script should only be sent after a key check passes.
  • Was it obfuscated? Plain source can be read by anyone who gets it. See how to protect a script from being decompiled.
  • Were keys locked to devices? If not, one buyer can share with everyone. Our key system guide goes through the setup.

How LuaProtect helps here

Most of these steps are one click in LuaProtect: revoke a key, ban by HWID, IP or Roblox user (anyone running the script at that moment is kicked straight away), see live sessions and execution stats, and roll back to an earlier version if a rebuild goes wrong. Bans, keys and stats are on the free plan.

The short version

  1. Find out what leaked: a key, the loader, or the source.
  2. Revoke keys and ban the devices involved.
  3. Use your execution stats to see how far it spread.
  4. Ship a fresh obfuscated build and rotate any secrets.
  5. Point your community to the official loader.
  6. Fix the gap so it doesn't happen again.