Stored AES-256-GCM encrypted in D1. Only clients with a valid active session can pull it. Paste your Lua source and upload — never stored in plaintext.