FiveM security: how to protect your scripts and the AI skill that applies it

FiveM security at the script level comes down to one rule: never trust the client. The game client runs on the player's machine and can be fully compromised. An executor can call any net event your resources register, with any arguments, from anywhere on the map. If you write server-side Lua for an economy, inventory, shop or job, this applies to you. The FiveM security skill gives your AI assistant the rules to write handlers that assume the client is lying.

What the FiveM security skill gives you

The SKILL.md is short on purpose. It states the core philosophy and four golden rules, then points to rules/events.md for the details on structuring and validating RegisterNetEvent and TriggerServerEvent.

• Server authority. The server dictates the truth. The client only requests actions.
• Never trust parameters. If a client says "give me $50", the server checks that the player earned it. The amount comes from server-side state, not from the event argument.
• Distance checks. Before looting, selling or any zone interaction, the server compares the player's position with the target.
• Rate limiting. Critical actions get a server-side cooldown or debounce so a spammed event does not run a thousand times per second.

This skill focuses on script-level defense. It is not a full anti-cheat product and does not replace one. It makes your own events harder to abuse, which no external tool can do for you.

Common mistakes with FiveM security

• Giving money or items from a client-sent amount. The handler reads amount from the event and pays it. Symptom: a player shows up with millions after a night with an executor. Fix: compute the reward on the server from what the player did, and ignore any value the client sends.
• No source validation and no permission check. The event runs for whoever triggers it, without checking that the player is allowed to do that action or is in the right job. Symptom: anyone can open the police armory. Fix: resolve source first, load the player and verify the action is allowed for them.
• No distance check. Shop, loot and NPC events fire from across the map. Symptom: a player sells at every shop at once without moving. Fix: get the player ped position on the server and reject the event if it is farther than a few meters from the target.
• No cooldown. The event can be triggered in a loop. Symptom: duplicated rewards and lag for everyone. Fix: keep a per-player timestamp for critical events and drop anything that arrives before the cooldown ends.
• Client-side "anti-cheat" only. Checks like "is the player near the shop" live in the client script. They run on the compromised machine, so a cheater removes them. Fix: keep client checks for UX, and repeat every check that matters on the server.

Why AI assistants get FiveM security wrong

A generic assistant learned from thousands of public FiveM scripts, and most of them trust the client. Ask it for a "sell items" event and you get a handler that takes item and price from the client and pays it. It works in testing and it is an open door. Assistants also put distance and permission checks in the client because that is where the examples put them.

The FiveM security skill flips the default. The assistant reads the golden rules and rules/events.md before writing a handler, so it validates source, derives amounts from server state, checks distance on the server and adds cooldowns for critical actions. The starting point becomes a handler that assumes the client is hostile.

Install the FiveM security skill in 30 seconds

1. Click "Download SKILL.md" at the top of this page.
2. Unzip it into the skills or rules folder of your AI tool. The install section below shows the exact path for Claude Code, Cursor and VS Code.
3. Ask the assistant for something concrete, like "write the server event for selling fish at the docks", and check that it validates source, checks distance on the server and computes the payout without trusting a client-sent price.