Document IonCube protection and PHP 7.2/7.4 lock

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -156,6 +156,29 @@ XUI's bundled `my.cnf` sets `bind-address = *`, so MariaDB listens on
 socket auth, but consider firewalling 3306 to localhost if the box is on a
 public IP.
 
+## How the panel code is protected (IonCube)
+
+XUI's application code is **IonCube-encoded**, not editable source:
+
+- ~294 of 308 `.php` files are encoded binary (a handful, e.g. the Ministra
+  portal, are obfuscated plaintext instead).
+- It uses a **custom IonCube loader** keyed via `ioncube.loader.key.xui` in the
+  bundled `php.ini`. The encoded files are headerless binary and only run under
+  that keyed loader — a stock IonCube loader can't decode them.
+- The community "patch" is exactly this loader: a custom-built `ioncube.so`
+  (shipped for **PHP 7.2 and 7.4**) that runs the still-encrypted code without
+  the original license/phone-home enforcement.
+
+**Consequences:**
+
+- You can't read or modify XUI's PHP source — customization is limited to config,
+  templates, and the database.
+- **PHP is locked to 7.2 / 7.4.** There is no loader here for PHP 8.x and the
+  encoded files won't run on it — which is why XUI ships its own bundled PHP
+  7.4.10. Don't repoint it at system PHP 8.
+- The load-bearing piece is that bundled `ioncube.so` + key (inside `xui.tar.gz`,
+  already in the mirror). Keep the mirror intact.
+
 ## System requirements
 
 - Ubuntu 20.04 / 22.04 / 24.04 LTS, clean install, x86_64