Versioned source audit · 1.3 versus 1.4.9
Public 1.3 source stored account metadata and a Windows DPAPI-protected cookie string inside Settings.json. Applying an account decrypted the cookie, logged a short preview and attempted to write the full value into Roblox local stores.
Current answer: that historical design is auditable. Luczystrap 1.4.9 is not. Its release notes identify the LocalAppData folder, but current source does not expose the account schema, encryption, logs, copies or deletion path.
01 / Evidence boundary
A current release number cannot inherit security claims from old source. Every statement below is labeled by the evidence that actually supports it.
Public classes show the data model, JSON persistence, DPAPI calls, logs, account removal and attempted writes into Roblox storage.
The notes ask users to reset the LocalAppData Luczystrap folder and mention State.json. They do not document current RobloxAccounts fields or account behavior.
02 / Storage inspector
Select a location to see its path, contents, protection and retention. Paths refer to public 1.3 code; the configured base could differ for custom or detected portable installs.
Select a storage surface
JsonManager serialized the Settings object to the Luczystrap base directory. RobloxAccounts contained identity fields and a Base64 representation of the Windows ProtectedData result.
%LocalAppData%\Luczystrap\Settings.jsonUser ID, names, avatar URL, active state, last-used time and SecurityCookie.
Other metadata remained ordinary readable JSON fields.
The source did not define age-based cleanup for Settings.json.
Do not upload this file: encrypted-at-rest does not make an account record appropriate for a public issue or chat.
03 / Data inventory
This is the serialized 1.3 model, not an inferred list. Sensitivity describes disclosure impact, not whether every field was encrypted.
| Field | Meaning | Historical storage | Sensitivity | Evidence |
|---|---|---|---|---|
| UserId | Numeric Roblox account identifier | Readable JSON number | Account | RobloxAccount model |
| Username | Unique Roblox account name | Readable JSON string | Account | Authenticated-user response |
| DisplayName | Current display label | Readable JSON string | Identity | Authenticated-user response |
| AvatarThumbnailUrl | Headshot image URL | Readable JSON string or null | Identity | Thumbnail API response |
| SecurityCookie | Stored session credential | Base64-encoded DPAPI ciphertext | Critical | EncryptCookie + model |
| IsActive | Whether the account was selected | Readable JSON boolean | Account | RobloxAccount model |
| LastUsed | Local account-switch timestamp | Readable serialized DateTime | Activity | SwitchAccount and model |
| ActiveAccountId | Selected account reference in Settings | Readable JSON number or null | Account | Settings model |
04 / DPAPI boundary
Historical code called ProtectedData.Protect with DataProtectionScope.CurrentUser and no optional entropy, then converted the encrypted bytes to Base64 for JSON storage.
The credential was present in application memory before protection.
The result was associated with the current Windows user context.
Base64 allowed binary ciphertext to be serialized inside JSON.
Unprotect restored the usable cookie before validation or application.
05 / Plaintext trace
Source review establishes that the code attempted these operations. It does not prove every Roblox client version accepted the generated SQLite or LevelDB data.
The selected account’s SecurityCookie was decrypted into a .NET string.
The code logged account names, cookie length and the first 20 characters.
The full value was inserted into a SQLite cookies table value column.
The full value was also written into a generated LevelDB-style file.
Important: the same method first deleted several Roblox Cookies, Local Storage, Session Storage and IndexedDB locations. This broad mutation belongs to historical 1.3 source and must not be assumed for 1.4.9.
06 / Current verification gap
The release notes confirm that `%LocalAppData%\Luczystrap\` and `State.json` exist in the current release workflow. They do not answer any of these account-specific questions.
Does the released binary still expose Account Switcher or accept a browser cookie?
Which identity, session and timestamp values are saved today?
Is DPAPI still used, with which scope, entropy and error behavior?
Are backups created, what is logged, and how long are files retained?
Does current code write any decrypted value to Roblox storage or another process?
Which files and values are removed, overwritten or left behind after account deletion?
Official wording until verified: historical 1.3 account storage is documented above; current 1.4.9 account storage remains unknown. A LocalAppData path in release notes is not evidence of a current encrypted-account implementation.
07 / Exact questions
Short answers tied to a version and a specific source boundary.
Inside the RobloxAccounts collection in Settings.json, relative to the configured Luczystrap base directory. The installer default was `%LocalAppData%\Luczystrap`, but custom or detected portable paths could differ.
No in public 1.3 source. The cookie was protected by Windows DPAPI under CurrentUser, and the ciphertext was represented as Base64 in the SecurityCookie field.
No. Base64 is an encoding that allows binary data to be stored as text. In this design, security came from DPAPI, not from Base64.
Microsoft says applications running with the same user credentials can unprotect CurrentUser data. DPAPI is useful protection at rest, but not a sandbox between every process running as that Windows user.
Yes in the historical apply path. It logged the cookie length and a preview of the first 20 characters, plus account names. The logger attempted to delete files older than seven days.
Yes. After a JSON load failure, historical JsonManager attempted to copy the original file to Settings.json.bak before saving replacement settings.
The 1.3 source attempted to write it into a SQLite Cookies database and a Local Storage LevelDB-style file. That proves implementation intent, not successful runtime compatibility with every Roblox version.
Current primary evidence does not establish it. The app source is unavailable and release notes do not document the account model, encryption, logs or deletion path.
Do not assume so. Historical RemoveAccount only changed local settings. If the cookie may have been exposed, use the official-session recovery sequence.
08 / Primary evidence
Each historical claim points to public code. Current limitations point to the present repository and release notes.
Checked August 6, 2026. This page documents code present in public tag 1.3. It does not claim that the generated Roblox SQLite or LevelDB files worked in every runtime, or that release 1.4.9 retains the same feature. The 1.4.9 application source was unavailable, so present account storage, log contents and deletion behavior remain unverified. Do not upload Settings.json, its backup or unreviewed logs to request support. Luczystrap is not affiliated with or endorsed by Roblox Corporation.