Trusted Resources

Sometimes one of your own scripts has a good reason to do something the anticheat dislikes, such as an admin menu that makes you invisible, a job script that teleports you, or a revive that changes health. Whitelisting the whole player is too much. AllowDetection gives one player a short bypass for one detection category.

#Two ways to use it

1. The export. Any resource can call it right before the action:

exports["sbanticheat"]:AllowDetection("teleport", 5)               -- client script
exports["sbanticheat"]:AllowDetection("teleport", 5, playerSrc)    -- server script

No config change is needed. To allow only certain resources, set allowAnyResource = false and list them in shared/trustedresource.lua.

2. The list. If you can't edit the other script, list it in shared/trustedresource.lua:

SB.trustedResources = {
    ['tk_drugs']     = { invisibility = true },
    ['my_adminmenu'] = { invisibility = true, teleport = true, noclip = true },
}

When a detection in one of those categories fires while the listed resource is running, SB AntiCheat exempts that player for a short window (autoExemptSeconds, 10 by default) instead of punishing straight away. It renews while the detection keeps firing, up to autoExemptMaxSeconds (60 by default). After that, normal punishment applies.

⚠️ SB AntiCheat can't tell which resource caused the detection. While a listed resource is running, a cheater using the same category gets the same short window. Keep the list small, and make sure the key matches the real resource folder name.

#Categories

#How it behaves

• The caller is identified by FiveM. The resource name comes from GetInvokingResource(). Arguments you pass are not trusted for this.
• One player, one category. Other players and other detections are not affected.
• It expires by itself. A single bypass never lasts longer than maxDuration.
• Renewing is capped. One continuous bypass can't run longer than maxContinuous (60 seconds by default), so it can never become permanent.
• Refused calls explain why. The reason is printed to the F8 console (client) or the server console. sb trust in the server console lists active bypasses.
• Everything else is unchanged. Logging and punishment still apply to anything not exempt.

#Settings

SB.trustedSettings = {
    allowAnyResource = true,    -- false = only listed resources may use the export
    autoExempt       = true,    -- false = turn off the automatic list behaviour
    autoExemptSeconds    = 10,  -- length of each automatic window
    autoExemptMaxSeconds = 60,  -- most seconds in total before normal punishment
    maxDuration      = 15,      -- longest single bypass, in seconds
    maxContinuous    = 60,      -- longest a renewed bypass can run, in seconds
    capPause         = 3,       -- forced gap after that, in seconds
    cooldown         = 0,
    maxClientRequestsPerMinute = 20,
    maxClientBypassSecondsPerMinute = 30,
}

#Server or client?

The server export is stronger. The server checks the calling resource and needs the player ID. The client export needs no player ID and also informs the server, but client requests are rate limited and capped because a client can never be fully trusted. If you are worried about cheat code running inside one of your resources, set allowAnyResource = false.