Yes, I put leak in quotes because it hasn’t been officially announced as far as I’ve seen.
Without info, it’s hard to say. Maybe each subscription will have a unique ID that can be queried from any game, much like marketplace assets.
To hide the code, could it be hosted securely externally and sent through an HTTP request and run via loadstring()? I’m not sure how viable that it, but it sounds plausible.