Security
Lurelock is local-first. Everything it does happens on your machine, and nothing about your account or your game leaves it. This page covers the launch lock, the threat model, and what the exe does with your data.
In Settings → Security you can set a password. While it is on, Roblox cannot be launched through Lurelock until the password is entered — it is enforced at the launch handler on every play or Studio start, including website links.
stored as salted SHA-256 · never plaintext · compared in constant time
Analytics are off by default. When you flip the toggle on, a small anonymous event log (app version, launches, error reports) is sent to the Lurelock maintainers - nothing personal, and only while enabled. Network communication is otherwise limited to Roblox's own CDNs and the GitHub releases API for update checks.
Your configuration is a readable Settings.json next to the exe. Nothing is obfuscated or hidden. The only secret is the launch password, which is kept hashed.
Every release page carries the SHA256 of its exe. You can verify your download against it:
certutil -hashfile Lurelock.exe SHA256Recommendations
- Use the launch lock if you share the machine or want to stop accidental opens.
- Install from the latest release only — never from random "Bloxstrap/Lurelock" downloads.
- SmartScreen will warn because the exe isn't code-signed. That is expected; verify the SHA256 if you're unsure.
report a vulnerability or an impersonation site: open an issue at github.com/justsadnyx-ux/lurelock/issues/new