HWID & Security Measures

1. Purpose

This page explains how Veyra protects accounts and script access. It is informational and works together with our Terms and Privacy Policy. Security measures may change as we harden the platform.

2. What is an HWID?

An HWID (hardware / client identifier) is a string your executor or client environment provides when authenticating with Veyra. Common sources include executor gethwid() APIs or Roblox client analytics IDs when a custom HWID function is unavailable.

We use HWID to bind a license key to roughly one machine/environment so shared keys and casual redistribution are harder.

3. How HWID binding works

• On first successful key verify, we store the HWID on your account/license record.
• Later verifies from a different HWID are rejected until you reset HWID from the dashboard (subject to cooldown) or staff clears it.
• Executor sessions are checked against the bound HWID on heartbeat / script fetch where applicable.
• Heartbeat traffic may send a hashed form of the HWID on the wire while the server keeps the stored binding for matching.

4. HWID resets

Customers can request an HWID reset from the dashboard when available. Resets are rate-limited (typically one successful reset per 24 hours) to limit key sharing. Staff may clear HWID for support cases. Abuse of resets can still lead to bans.

5. Bans & abuse controls

• HWID bans block verification from that identifier on every key and session check
• Banning an HWID also blacklists the linked account(s), so they cannot bind a new HWID or use the Service until staff restores access
• IP bans may apply for repeated abuse
• Keys can be revoked; trials/sessions can be killed by staff
• Signup and sensitive routes use rate limiting

Spoofing HWIDs, rotating VMs solely to evade locks, or automating unlock abuse violates our Terms and may result in permanent loss of access.

6. Account security measures

• Passwords hashed with argon2id (legacy bcrypt hashes accepted once, then upgraded on login). Not reversible plaintext.
• Operators cannot set or read your password. Self-service recovery: email + optional license key → short-lived link to set a new password (old hash replaced; re-login required). We never have plaintext.
• Optional security keys / passkeys (WebAuthn: YubiKey, Windows Hello, phone) on Account
• Separate portal and staff session cookies (httpOnly, signed JWTs; Secure in production HTTPS)
• Email verification when mail delivery is configured
• Staff actions gated by permission checks

7. Encryption at rest & in transit

• Sensitive local JSON stores and showcase assets use AES-256-GCM envelopes when DATA_ENCRYPTION_SECRET (or AUTH_SECRET) is configured
• Production traffic is HTTPS / TLS (e.g. nginx or site TLS). Passwords and session cookies are not sent over plaintext HTTP in production

8. Script & media protection

• Script bodies are served only after key/session validation where required
• Showcase images can be stored encrypted at rest (AES-GCM) and served through authenticated asset routes
• Library/loader endpoints exist so executors can load shared Lua; treat them as sensitive platform IP

No client-side system can fully prevent determined reverse engineering. HWID and key checks raise the cost of casual sharing; they are not a guarantee against all attacks.

9. What we expect from you

• Use a unique, strong password (and a security key when you can)
• Do not share keys, loadstrings with embedded keys, or session tokens
• Do not attempt to bypass HWID, bans, or verification
• Report suspected account compromise to support

10. Limitations

Security is layered, not absolute. Compromised executors, malware on your PC, leaked keys, or platform bugs can still expose access. HWID locks do not make use "undetectable" or authorized by Roblox. Veyra is provided as described in the Terms with no warranty of perfect security and no liability for third-party bans arising from your use of scripts.

11. Contact