Secure Mode

Secure Mode is an early-load privacy and asset policy for XLQP Gen1. It changes how the library handles output and media assets before the UI is created.

Interface previews

Enable and verify it

getgenv().XLQP_SECURE = true
getgenv().XLQP_ASSET_ID = nil
getgenv().XLQP_ASSET_IDS = nil

local Library = loadstring(game:HttpGet("https://raw.githubusercontent.com/josediaz765/XLQP-UIS/main/xlqp%20gen1"))()

Loader header globals

Every global in this table is read from getgenv() while the source loads, so all of them must be set before the loader runs. Setting one afterward has no effect.

To use a custom image under Secure Mode today, it has to be registered as a built-in asset. XLQP registers its own icon set this way at startup, and it registers an asset ID automatically when one is supplied as a custom background. Any ID that was never registered stays blank, which is the fail-closed behavior described below.

Two further globals control re-execution rather than security, and are documented separately: XLQP_REEXECUTE_SOURCE and XLQP_AUTO_REEXECUTE_SOURCE.

What Secure Mode changes

The descendant watcher covers the property sets it can act on:

Values that already start with rbxasset://, content://, or synasset:// are skipped by the watcher, since they are treated as local or internal.

Asset decision flow

XLQP receives an asset value
├── Internal rbxasset://, content://, or synasset:// value
│   └── Keep it
├── Registered XLQP built-in image ID
│   └── Download → validate image bytes → cache → load as a custom asset
├── Supported avatar/game thumbnail in an allowed component
│   └── Request thumbnail → validate → cache → load as a custom asset
└── Unapproved remote or numeric asset value
    └── Leave the protected property blank

The image validator accepts PNG, JPEG, GIF, and WebP signatures. Files are cached under:

XLQPGen1/secure-assets-v3

XLQP recognizes an asset ID from any of these forms before deciding whether it is an approved built-in:

rbxassetid://1234567890
https://www.roblox.com/asset/?id=1234567890
https://www.roblox.com/library/1234567890
https://create.roblox.com/store/asset/1234567890
https://assetdelivery.roblox.com/v1/asset/?id=1234567890
1234567890

Recognizing the ID is not the same as allowing it. An ID that XLQP did not register as a built-in is still left blank.

Runtime requirements

Secure image resolution needs the following functions from the client environment:

• makefolder
• isfolder
• writefile
• isfile
• getcustomasset or getsynasset
• an available HTTP path such as game:HttpGet, request, http_request, or syn.request

If the filesystem or custom-asset functions are unavailable, a protected image that needs conversion remains blank. This is an intentional fail-closed behavior.

Supported values

Secure Mode is not the anti-detection layer

Secure Mode, Anti Logger, and the spoofers are three separate systems. They can all be active at once, but each protects a different surface.

getgenv().XLQP_SECURE = true
local Library = loadstring(game:HttpGet("https://raw.githubusercontent.com/josediaz765/XLQP-UIS/main/xlqp%20gen1"))()

local Window = Library:MakeWindow({
    Branding = {
        Name = "My Hub",
    },
    Security = {
        AntiLogger = true,
        Mode = "Better",
        DiscordWebhookWhitelist = {
            "https://discord.com/api/webhooks/APPROVED_ID/APPROVED_TOKEN",
        },
    },
})

Anti Logger

Configuration

Mode also accepts the older ProtectionMode window key. The whitelist accepts several equivalent field names — DiscordWebhookWhitelist, DiscordWebhooks, WebhookWhitelist, WhitelistWebhooks, and Whitelist — and merges every one it finds. Each accepts either a table of links or a single string of links separated by commas or whitespace.

Modes

"Better" re-installs its wrappers on a loop because another script can overwrite a global request function after XLQP starts. That refresh is what the mode buys you; the pattern list is identical in both modes.

Sub-toggles

Two independent switches decide which category is actually blocked. Both default to true, and the master switch is recomputed from them when you change either one at runtime.

Library.AntiLogger.BlockWebhooks = false
Library.AntiLogger.Enabled = Library.AntiLogger.BlockIPLoggers or Library.AntiLogger.BlockWebhooks
Library:InstallAntiLogger()

Turning both off leaves Enabled false and every URL passes.

Covered request paths

Blocked pattern list

discord.com/api/webhooks     discordapp.com/api/webhooks
webhook.site                 canarytokens.com
ipify.org                    ipinfo.io
ip-api.com                   ipapi.co
ipwho.is                     icanhazip.com
ifconfig.me                  myexternalip.com
geolocation-db.com           ipregistry.co
ip2location.io               ipgeolocation.io

Matching is a substring search against the lowercased URL, so a subdomain or a longer path still matches.

What a blocked request receives

The call returns normally rather than raising an error, so a script that does not check the response will see empty data instead of a failure. Each distinct blocked URL also raises one Anti Logger notification the first time it is seen.

Automatically whitelisted destinations

XLQP whitelists the endpoints its own features need, so you do not have to list them:

raw.githubusercontent.com/evoincorp/lucideblox/...icons.json
https://discord.com/api/v10/invites/
https://discord.com/api/invites/
https://v0-auth-xlqp.vercel.app/api/login
https://ipinfo.io/json
https://text.pollinations.ai/
https://api.adviceslip.com/advice
https://v2.jokeapi.dev/
https://uselessfacts.jsph.pl/

Your configured Discord invite, the Discord auth URL, any tab FeedbackWebhook, and Config Cloud profile webhooks are whitelisted as they are registered.

Runtime methods

Spoofers

The spoofers change what identifying calls report. They are runtime-only: there is no MakeWindow field for them, and they start disabled.

if Library:SecurityHookSupported() then
    Library.SecuritySpoofer.Executor = "My Executor"
    Library:SecuritySet("ExecutorSpoofer", true)
end

Library:SecurityHookSupported() reports whether any of hookmetamethod, hookmethod, hook_method, hookfunction, or hookfunc exists. Library:SecuritySet(name, value) returns false and notifies the user when a toggle is requested on an executor that cannot support it, so check its return value rather than assuming the toggle took effect.

ExecutorSpoofer is the exception to that gate: when identifierchanger is available it is applied directly, without requiring hook support.

Values are read from Library.SecuritySpoofer — Executor, Username, UserId, Platform, and HWID. Set the value before enabling its toggle; the spoofer reads the field when it installs.

Built-in Security tab

Enabling the built-in tab gives users the same controls without extra code:

local Window = Library:MakeWindow({
    Branding = { Name = "My Hub" },
    BuiltInTabs = {
        Enabled = true,
        Security = { Enabled = true },
    },
})

The tab exposes a Protection Mode dropdown (Weak / Better), Anti IP Logger and Anti Webhook toggles, a Whitelist Webhook textbox, the five spoofer toggles with their input fields, and three buttons: Check Support, Refresh Protection, and Show Status.

Limits of each system

These are defense-in-depth options, not a sandbox.

Secure Mode

• It does not encrypt, hide, or authenticate your XLQP source URL.
• It does not protect secrets hard-coded in your loader or configuration.
• It does not make untrusted plugin source safe to execute.
• It does not block every possible network API or custom function supplied by the runtime.
• It does not suppress print or warn calls made by your own script; it only changes the functions captured by XLQP internally.
• It does not guarantee that every executor implements filesystem, request, hook, or custom-asset functions correctly.
• It does not replace server-side permission checks, authentication, validation, or rate limits.

Anti Logger

• It checks URLs against a fixed pattern list. A logger on any other domain is not matched.
• It cannot see traffic that never reaches a wrapped or hooked function, including a request path a script captured before XLQP loaded.
• Its "Better" hooks are silently skipped when the executor lacks hookfunction or hookmetamethod, leaving only the wrappers.
• It blocks by destination, so it cannot tell a legitimate request from an exfiltration attempt to the same allowed URL.

Spoofers

• They are client-side and change only what a local call returns.
• They do nothing on an executor without hook support, which SecuritySet reports rather than hides.
• They do not conceal account or session information the server already has.

Never place tokens, private keys, webhook credentials, or private source links in public scripts or this documentation repository.

Recommended setup

-- 1. Set the header globals before loading the source.
getgenv().XLQP_SECURE = true
getgenv().XLQP_ASSET_ID = nil
getgenv().XLQP_ASSET_IDS = nil

-- 2. The placeholder has no public URL until release.
local Library = loadstring(game:HttpGet("https://raw.githubusercontent.com/josediaz765/XLQP-UIS/main/xlqp%20gen1"))()

-- 3. Verify the expected policy is active.
assert(Library:IsSecureMode(), "XLQP Secure Mode did not start")

-- 4. Anti Logger is already on; name the destinations you actually need.
local Window = Library:MakeWindow({
    Branding = {
        Name = "My Hub",
    },
    Security = {
        AntiLogger = true,
        Mode = "Better",
        DiscordWebhookWhitelist = {
            "https://discord.com/api/webhooks/APPROVED_ID/APPROVED_TOKEN",
        },
    },
})

-- 5. Confirm both categories survived any user changes.
assert(Library.AntiLogger.Enabled, "Anti Logger is off")

Troubleshooting

Continue with Installation, Window configuration, or the library reference.