FiveM Security

Activation Contract

Load for any net event handler, code granting money, items, vehicles or permissions, admin commands, ban logic, or questions about cheats, exploits or hardening.

Hard Rules

Never trust the client. The client REQUESTS; the server DECIDES from its own config and state.
Never accept prices, amounts, rewards or item names from the client. Derive them server-side.
GetInvokingResource() is nil for every net event crossing the network, player or cheater alike. NOT auth.
RegisterNUICallback is NOT authenticated: a cheater POSTs to any endpoint. Never the only gate before TriggerServerEvent.
Distance-check server-side: #(GetEntityCoords(GetPlayerPed(source)) - target), ~10 units.
Re-verify state server-side (job, item, cooldown) even if the client checked.
Rate-limit critical events; clear per-source state in playerDropped.
Filter native game events (weaponDamageEvent, startProjectileEvent, removeAllWeaponsEvent, ptFxEvent) with AddEventHandler + CancelEvent().
Authorize admin actions with ACE only: IsPlayerAceAllowed(source, object). Never an identifier list.
Key persistent data on license:. steam: is absent for non-Steam launches.
The sandbox blocks writes outside the resource's own folder, os.execute and io.tmpfile().
Log rejections. Escalate on counts, never auto-ban on one hit.

Decision Gates

| Situation | Reference | |---|---| | Client-sent price, amount, or any argument | rules/events.md | | Repeated or spammable event | rules/rate-limiting.md | | Damage, projectile, weapon strip, particles | rules/net-game-events.md | | Admin command or admin-only event | rules/ace-permissions.md | | Ban, whitelist, persistent record | rules/identifiers.md | | Resource writes files or spawns processes | rules/sandbox.md | | Hardening the server itself | rules/server-convars.md |

Execution Steps

List every net event and NUI callback and the state each changes.
Strip client values the server can compute itself.
Add type/range, distance and state checks at the top; return early.
Cooldown or token-bucket anything spammable; clean up on drop.
Gate admin paths behind IsPlayerAceAllowed.
Add game event filters for damage, projectiles, weapons.
Log rejections with name and source id.

Output Contract

Return hardened handler(s) with validation, distance, ACE and state checks first; name the client parameters removed; include required server.cfg lines.

References

rules/events.md — handlers, distance, NUI callbacks.
rules/net-game-events.md — game event payloads, cancelling.
rules/ace-permissions.md — principals, objects, ACE guards.
rules/rate-limiting.md — cooldowns, token buckets, cleanup.
rules/identifiers.md — license:, tokens, deferrals.
rules/sandbox.md — filesystem, process, convar limits.
rules/server-convars.md — hardening convars.

Upstream docs: https://docs.fivem.net/docs/scripting-manual/