Configuration

SafeGuard is configured in two places:

Dashboard → Rules: with the cloud connected, this is where each server's detections and punishments are set. Every change is versioned and audited, reaches the server within seconds, and you can Restore an older version from History.
`config.lua`: framework, staff, language, local evidence and alerts, and the protection policy used without the cloud (Config.Protection). sg reload applies changes without a restart.

Secrets (license key, Discord webhook) never go in config.lua: they go in server.cfg with set.

Detections

In Rules → Detections you can switch any detection off or change its sensitivity (0 = most tolerant, 100 = most aggressive). If a detection gives false positives on your server, lower its sensitivity rather than switching it off, and mark the wrong detections as false positive: SafeGuard learns and gives them less weight.

Punishments

Punishments depend on the player's risk (0–100), which adds up the weight of each detection and decays over time. The default rules:

Rule	When	What happens
honeypot	Honeypot event triggered	Quarantine, staff review, screenshot
extreme	Risk ≥ 95 and "ban gate" open	Permanent ban
critical	Risk ≥ 80	Quarantine, staff review, screenshot
high	Risk ≥ 60	Staff review
suspicious	Risk ≥ 40	Watch

The ban gate protects against unfair bans: it only opens with at least one server-verified signal at 80% confidence or more, or with signals in two independent categories. Signals that only come from the client never lead to an automatic ban. Quarantine means the player stays connected but cannot deal damage, spawn entities or earn money until released.

For the first weeks we recommend punishments with staff review only, or the server page's learning mode, to see how detections behave on your server before enabling automatic bans.

Recommended lists and traps

In Rules → Entities and Rules → Weapons the lists are a checklist by category (with search). What cheat menus use comes ticked; untick what your server uses and type addon models or hashes under Other. Restore SafeGuard's defaults goes back.

Weapons: railgun, ray guns, minigun, launchers, grenade launcher, sticky bombs and mines are removed from whoever has them.
Vehicles, props and animals: deleted as soon as a player's game creates one. Tanks, military jets, Oppressor, Deluxo and other weaponized vehicles, huge props menus drop on players (ferris wheel, windmill, UFO) and whales/sharks on land.
Known menu commands: commands menus such as Eulen or Lynx register in the game.
Recommended explosions: blimp, orbital cannon, explosive ammo and others roleplay servers do not have.
Exploit traps: catch menus firing the payout, item and jail events of popular scripts your server does not run. Events of scripts you run are never trapped. One trap on its own is only a note, because a replaced script can fire it; three different traps within two minutes are a menu sweeping the server, and that is a ban.

If your server really uses one of those weapons, props or explosions, switch the list off or add the model to Allowed models.

Extra protections

Car rain: several vehicles created far from the player (or high above them) in a short time are blocked. One car at a garage spot never counts.
Taser: tazing from more than 22 m away or in a loop (more than 15 a minute).
Kill player: punches and melee weapons landing from more than 8 m away.
Explosions, fire and particles: in Rules → Entities you can block them entirely. Off by default, because grenades, molotovs and burning cars are normal gameplay.
Safe zones: in config.lua (Config.SafeZones), areas where your scripts stop players taking damage. Inside them, damage with no effect is not treated as godmode.
Ban by combined proof: in Rules → Punishments. Bans a player when two independent kinds of cheat are confirmed within 10 minutes, for example noclip and godmode. It starts in Observe only, which records who would have been banned without punishing anyone; check those players before turning bans on.
Anti-VPN: in config.lua (Config.AntiVpn), off by default. Checks the IP of whoever connects with the public proxycheck.io API and refuses VPNs and proxies; it sends the IP to that service, so mention it in your privacy policy. Without a key it makes about 100 checks a day; a free key (set safeguard_proxycheck_key "…" in server.cfg) raises the limit. If the service does not answer, the player is let in.

Bypasses

In Rules → Bypasses you can exempt a player from some categories for a while (for example an event with teleports). Staff with safeguard.bypass (or the configured framework permission) are never scored.

config.lua (local mode)

Config.Protection = {
    movement = { maxFootSpeed = 14, teleportDistance = 120, vehicleHijack = true, vehicleGodmode = true },
    weapons = { recommendedBlacklist = true, blacklist = { 'weapon_rpg' }, inventoryCheck = true, inventoryIgnored = { 'weapon_flashlight' } },
    entities = { recommendedModels = true, blockedModels = { 'prop_beach_fire' }, attachAllowedModels = { 'p_cs_cuffs_02_s' } },
    explosions = { recommendedTypes = true, maxPerWindow = 5 },
    eventShield = { exploitProbes = true, markupInjection = true, honeypots = { 'myserver:adminGiveMoney' }, fanout = { maxDistinct = 20, windowMs = 5000 } },
    combat = { maxKillsPerMinute = 8 },
    detections = { ['movement.spectate'] = { enabled = false } },
}

The names are the same as in the dashboard. Unknown names are reported in the console, so typos never go unnoticed.

PreviousPermissions NextFrameworks