Leaks go nowhere
A key posted to a leak site binds to whoever runs it first, then refuses every other machine that tries it.
HWID locking
One key. One machine.
In plain terms: one key = one device. If someone leaks or shares a key, it won't work on anyone else's computer. Turn on HWID locking and a license binds to the first device that runs it; a different machine is refused, and players reset their own binding when they genuinely switch devices.
Opt-in per script. One toggle, off by default.
How it works
Bind on first run, enforce on every run.
The first time a key verifies, the device's reported hardware id is recorded and the key is bound to it. From then on, every verify checks the reported id against the bound one, and a mismatch is refused. The check runs server-side, inside the verify handshake, not in the client, where it could be patched out.
What it stops
A shared key is a one-machine key.
Sharing breaks
One key can't quietly serve a whole group. Each device needs a key of its own, which is the point.
Enforced on the server
Binding is checked in the verify handshake, so a modified client can't simply skip the check.
Resets
Players switch machines without opening a ticket.
Real people do change devices. Each key gets a bounded number of HWID resets. You set the allowance, and the default is three. A player resets their own binding from the Discord bot (/resethwid or the Reset-HWID button) or the dashboard, and the next machine to run the key becomes the new bound device. The allowance is what stops a shared key from being reset forever.
Enabling it
One toggle in the script's settings.
HWID locking is opt-in per script. Turn it on in the script's settings and set how many resets a key may use. Everything else (the binding, the enforcement and the reset counter) is handled for you. Leave it off and your keys stay device-agnostic.
What it is, honestly
It raises the cost of sharing. It isn't DRM.
The HWID is a value the client reports, so it is as trustworthy as the client that reports it, a point vodka makes everywhere about client-side data. HWID locking makes a leaked key far less useful and a shared key impractical; it does not turn a client into a vault. Keep real secrets and authority on the server.
Lock it down
Turn on HWID locking for your next release.
Open a script, enable HWID locking and choose a reset allowance. Your keys start binding to one machine each on the next verify.