KeyguardSecurity
Truth lives on the server
No licensing API makes a binary uncrackable. Keyguard makes piracy expensive: entitlements, files, and minting stay off the client.
| Layer | What it does |
|---|---|
| Panel | Cloudflare Turnstile, email code, Argon2id, JWT |
| Client session | HMAC + nonce + timestamp after init |
| Passwords | Argon2id (owners, resellers, end users) |
| Seller keys | Header only, hashed at rest, prefix lookup |
| Files | Random IDs, SHA-256, auth-required default |
| Webhooks | SSRF allowlist, no seller key in the product |
| Rate limits | Register / verify / login / client / seller |
Your product still has a job
- Never embed seller keys.
- Compare file SHA-256 before writing to disk.
- Call
checkon a heartbeat so we can kill sessions. - Obfuscate your own binary if the threat model needs it. Keyguard is not a packer.