Server security baseline

Give permissions by role, not by person

FiveM grants powers through ACE permissions (Access Control Entries: the server's allow/deny rules for who may run what). Use groups so you can add or remove a staffer in one line. Grant the narrowest power that does the job. Only owners get the parent command object, which covers every server command.

add_ace group.admin command allow
add_principal identifier.fivem:00000 group.admin

In txAdmin, give moderators a limited role, not full admin. Review the admin list monthly and remove anyone who left.

Keep secrets out of the repo and out of chat

Your license key, database password, and Discord webhooks are secrets. Keep each one in a convar (a config variable set in server.cfg, read at runtime). Your server.cfg is not in your public repo, so the values stay private. Never paste a secret in Discord, a screenshot, or a video.

If a secret ever leaks, rotate it the same hour. To rotate means to throw the leaked value away and issue a fresh one, so the old one stops working. Get a new license key at portal.cfx.re and set a new database password.

Trust only resources you can read or vouch for

Every resource you ensure runs with full server power. (ensure is the server.cfg line that starts a resource and keeps it running.) So a bad script can do anything your server can do. Install from the official author only.

Before you run an unknown script, open its server-side .lua files and look for three red flags:

• A PerformHttpRequest call to a web address you do not recognise. That is the script phoning out to someone else's server.
• A long unreadable blob of letters and numbers (base64). Hidden code is often packed this way so you cannot read it.
• load() or assert(load(...)) running text the script fetched from the internet. That runs code the author can change later, without you seeing it.

If you cannot read it, and you cannot trust who made it, do not run it.

Lock down webhooks and logging

A webhook URL is a one-line address Discord gives you that posts messages into a channel. Anyone who has the URL can post to that channel, so treat it like a password. Store webhook URLs in convars, send them only from the server side, and never expose them to clients.