Production code review checklist

Code review is how teams keep quality up without heroics. This is the FiveM-specific checklist: the handful of things that, if you check them every time, catch most of what blows up a server. Use it on your own code before shipping and on teammates' pull requests before merging.

You'll build: A checklist to review a FiveM resource before it ships or merges, so the same mistakes stop reaching production.
Time: ~20 minutes.
You need: A resource to review (yours or a teammate's) and the core concepts from Track B.
You'll learn: Security checks -> performance checks -> correctness checks -> the questions to ask on every review

BEFORE YOU START

The checklist

Security

Server authority: Does the server validate every money/item/job/admin action, or trust a client event?
Event safety: Are net events validated for source and inputs? No raw client value used as truth.
SQL: Parameterized queries via oxmysql only. No string-concatenated SQL.
Secrets: No keys, passwords, or webhooks in the code. Read from convars. A hardcoded Discord webhook or DB password ships to every buyer and can be abused the moment the resource leaks.

Performance

Threads and Wait: No tight loops without a Wait. Idle loops use long waits, not Wait(0).
resmon budget: Does the resource stay well under budget at idle and under load?
Cleanup: Every spawned entity has a delete path on stop, drop, and timeout.
Distance work: Heavy per-frame work is gated by distance or state, not always running.

Correctness

Config: Tunables live in a config, not hardcoded magic numbers.
Errors: Failures are handled and logged, not swallowed silently.
Docs: A README explains install, dependencies, and config.
Versioning: Version bumped and changelog updated for the change.

Keep reading the full lesson

Still ahead in this lesson

How it works
Common mistakes
What you can do now