Documentation

Bastion v1 — Lua script protection platform

Getting Started

1. Create a Project

Go to your dashboard and click "Create Project". Give it a name that represents your script.

2. Add Your Script

Upload your Lua script. Bastion will obfuscate it with Luraph. Configure:

Free For All — no key required
Silent Mode — suppress loader output
Game ID — lock to a specific game

3. Generate Keys

Generate authentication keys for your users. Set expiration times and attach notes.

4. Distribute Loader

Copy the loader script from your dashboard and distribute it to your users.

Loader Script

Users execute this in their executor to authenticate and load your protected script:

lua

key = "USER_KEY_HERE"
loadstring(game:HttpGet("YOUR_LOADER_URL"))()

The loader handles HWID binding, kernel authentication, and script decryption automatically. For free-for-all scripts, the key line can be omitted.

Runtime Variables

These globals are injected into your script after successful authentication:

Variable	Type	Description
BST_IsUserPremium	boolean	true if user has a valid key
BST_LinkedDiscordID	string \| nil	Linked Discord ID
BST_ScriptName	string	Name of the script
BST_TotalExecutions	number	Total executions by this user
BST_SecondsLeft	number	Seconds until key expiry (math.huge if never)
BST_UserNote	string	Note attached to the key
BST_ScriptVersion	string	Script version string

Example usage:

lua

if BST_IsUserPremium then
    print("Welcome premium user!")
else
    print("Free tier")
end

if BST_SecondsLeft < 86400 then
    warn("Key expires in " .. math.floor(BST_SecondsLeft / 3600) .. " hours!")
end

Luraph Macros

Use these macros in your scripts to control obfuscation behavior. They are processed during obfuscation.

LPH_ENCSTRString Encryption

lua

local secret = LPH_ENCSTR("This string will be encrypted")

LPH_ENCNUMNumber Encryption

lua

local value = LPH_ENCNUM(12345)

LPH_CRASHAnti-Tamper

lua

if tampered then
    LPH_CRASH()
end

LPH_NO_VIRTUALIZESkip Virtualization

Use on hot-path functions (render loops, Heartbeat) to avoid performance issues:

lua

LPH_NO_VIRTUALIZE(function()
    -- Performance-critical code
    -- Not virtualized, still obfuscated
end)()

LPH_JITJIT Hint

lua

local fast = LPH_JIT(function(x)
    return x * x
end)

LPH_JIT_MAXAggressive JIT

lua

local superFast = LPH_JIT_MAX(function()
    -- Maximum performance code
end)

Webhooks

Configure Discord webhooks in your project settings for real-time notifications.

Alert Webhook

Security events: invalid keys, HWID mismatches, expired keys, blacklisted attempts, game ID mismatches.

Logs Webhook

Execution logs: script name, version, Discord ID, executor, HWID, IP, execution count.

Discord Bot

Manage your project directly from Discord with slash commands.

Command	Description
/login	Authenticate with your Bastion API key
/logout	Clear stored API key and panel config
/setpanel	Set up the script panel in a channel
/whitelist	Create a key and whitelist a user
/unwhitelist	Remove a user from the whitelist
/blacklist	Blacklist a user
/keyinfo	Look up information about a key
/userinfo	Look up information about a user
/compensate	Add days to user subscriptions
/force-resethwid	Force reset HWID (bypasses cooldown)
/stats	View project statistics

Panel buttons available to users:

Redeem Key

Get Script

Get Stats

Reset HWID

Bot Hosting

1. Create an Account

2. Configure Environment

Set these environment variables:

env

DISCORD_BOT_TOKEN=your_bot_token
DISCORD_CLIENT_ID=your_client_id
BASTION_API_URL=https://your-domain.vercel.app

3. Deploy

Upload the bot files and start the instance. Run register-commands.ts once to register slash commands.

Need help?

Join the Discord for support and updates.

Join Discord