FiveLabs Escrow / docs

Encrypted builds, short-lived grants and traceable leaks.

FiveLabs Escrow v0.2 removes standard local server and client Lua from the protected ZIP and stores it inside an AES-256-GCM FLX2 package. The permanent build key is not embedded in the runtime.

The runtime and loaders are intentionally treated as public. Patching a local license branch is not enough to decrypt FLX2 because the backend still controls access to the build key. Client code must still execute on player machines, so Client Shield is anti-dumper hardening rather than an absolute secrecy guarantee.

FLX2 architecture

Creator ZIP
   │
   ├─ server/client Lua ─► FLX2 AES-256-GCM package ─┐
   │                                                  │
   └─ other files ─────► protected ZIP                │
                                                      ▼
Authorized FXServer ─► X25519 session ─► signed key grant
        │
        ├─ decrypt server chunks in memory
        └─ Client Shield delivers client chunks at runtime

Each build uses a random 256-bit DEK. The backend stores that DEK wrapped by the FiveLabs master key. At runtime both sides generate ephemeral X25519 keys, derive a session wrapping key with HKDF-SHA256, and the backend wraps the DEK only to that authorized session. Package identity is Ed25519 signed.

Protect a resource

Create a resource in the dashboard.
Upload the original ZIP and choose a semantic version such as 1.0.0.
FiveLabs reads standard server_script(s) and client_script(s) declarations.
Matched local Lua files are removed from the output ZIP and encrypted into .fivelabs/payload.flx.
The generated manifest loads the thin FiveLabs runtime/loaders.

shared_script(s) remains readable in v0.2. Move sensitive logic out of shared files. External declarations beginning with @ are preserved.

Install a protected build

Give the customer the protected ZIP and a license key. Their server.cfg needs a persistent server ID and resource-specific license:

set fivelabs_server_id "4e5581e5-keep-this-stable"
set fl_license_flres_example "FLE-XXXXXX-XXXXXX-XXXXXX-XXXXXX"

ensure your_resource_folder

The server ID stays stable across restarts. The runtime verifies its local encrypted package, obtains a signed short-lived grant, decrypts in memory and revalidates authorization every five minutes.

Licenses

Only hashes of license keys are stored. Keys can have a server limit and optional expiry. Revocation blocks future runtime grants and causes running v0.2 resources to stop on the next heartbeat.

Leak tracing

Every allowed runtime session receives a trace derived from the license, server ID and build. The trace is inserted into decrypted server/client chunks. If extracted plaintext is leaked, use Dashboard → Leak Scanner to map the trace back to the matched resource, build, license and server.

Security limits

No DRM can make code that must execute on an attacker-controlled machine mathematically unrecoverable. An authorized server administrator or advanced client runtime hook can capture plaintext after decryption. FiveLabs is designed to make ordinary resource dumps/copies useless, require backend authorization, support revocation and make authorized leaks attributable.

Never place API tokens, Discord bot tokens, database passwords or authoritative permission decisions in client/shared/NUI code.

Production checklist

Run behind HTTPS only and use Cloudflare Full (strict).
Use a dedicated PostgreSQL account.
Back up the master encryption key and signing keys securely.
Do not expose port 3100 publicly; proxy through IIS/ARR.
Back up PostgreSQL and protected build storage.
Run npm run db:migrate after upgrading to v0.2.
Set the Discord OAuth redirect to https://escrow.gta5-labs.net/api/auth/callback/discord.