Security
Security at Trust Secure
Trust Secure is a security product, so how we protect your code and your account is part of the product itself. This page explains our approach in plain terms, without revealing sensitive implementation details.
Our security philosophy
We design so that a compromise of any single component reveals as little as possible. Secrets are minimized, encryption is authenticated, and the runtime loader verifies signatures rather than holding shared secrets.
We also try to be honest about limits. Code that runs on a machine you do not control can, given enough effort, be analyzed. We do not claim any protection is unbreakable. What we provide is strong, layered protection plus the monitoring, tracing, and revocation you need to respond when something goes wrong.
Script protection architecture
A high-level view of how your protected code is delivered and run.
Signed delivery
Protected code is delivered with a signature the runtime loader verifies before executing, so a spoofed or tampered delivery is rejected. The loader verifies authenticity with a public key and holds no secret worth extracting.
Encryption at rest
Protected bundles and sensitive values are encrypted at rest with authenticated encryption, and decrypted only for authorized runtimes.
Runtime authorization
Your code loads only after a license is verified as valid and active, so revocation takes effect on the next start.
Per-license delivery
Builds are delivered per license, which supports leak tracing without changing how customers install.
Account & data protection
Hashed secrets
License keys are stored only as hashes, never as plaintext. A database compromise does not reveal working keys.
Server-side enforcement
Every plan limit and entitlement is enforced on the server, so what an account can do is decided server-side, never trusted from the client.
Monitoring & alerts
Security events and usage are tracked per script, with optional Discord alerts for activations and anomalies.
Transport security
Traffic is served over HTTPS with modern transport-security headers.
Reporting a vulnerability
We welcome responsible disclosure from security researchers.
If you believe you have found a security vulnerability in Trust Secure, please report it to us privately so we can investigate and fix it before it is disclosed publicly. Contact us through the details on our contact page or our Discord, and include enough detail to reproduce the issue.
Please do not access or modify other users' data, degrade our service, or publicly disclose an issue before we have had a reasonable chance to address it. We appreciate reports made in good faith and will work with you on a fix and timeline.
Security FAQ
Is my code 100% safe from copying?
No product can honestly promise that for code that runs on machines you don't control. Trust Secure makes copying far more expensive, keeps readable source off the customer's disk, and gives you tracing and instant revocation to respond to leaks.
Do you store my license keys in plaintext?
No. Only a hash of each key is stored, so a database compromise does not expose working keys. If a customer loses a key, you re-issue it.
How is protected code delivered securely?
Through a signed loader that verifies a signature before running your code, with encryption at rest and runtime license authorization. A spoofed or tampered delivery is rejected.
How do I report a security issue?
Contact us privately via our contact page or Discord with reproduction details. Please practice responsible disclosure and avoid accessing other users' data.
Protect your work with security built in
Encryption, signed delivery, licensing, and monitoring — from one dashboard.
Get started free