Detections

Risk instead of bans on one flag

Each detection has a weight and a confidence. The player's risk (0–100) adds these up per category and decays over time. Weak or ambiguous detections (missed heartbeats, a single combat sample) are capped per sample, so a single occurrence never reaches a punishment.

Server signals (positions, entities, damage, events, money) are the basis of decisions.
Client signals (menu commands, injected resources, spectator mode) count half and never lead to an automatic ban on their own.
When staff mark detections as false positive or confirmed, SafeGuard adjusts that type's weight on your server (after 20 verdicts).

Against cheat menus

The most used menus (Eulen, Skript, and Lua menus executed through them) change all the time to avoid being recognised on the player's computer. That is why SafeGuard focuses on what they do on the server, which is the same whatever the menu:

teleporting, flying, noclip (also with collision off), super jump, speed, invisibility;
godmode (damage that does not lower health), health and armour above the maximum;
killing or tazing players with weapons not in hand, shooting through walls, aimbot (fast turns that always end on the target) and silent aim (hits with the aim beside the victim);
exploding players from far away, invisible or spammed explosions;
dropping huge props, spawning dozens of entities, huge particle effects;
pulling players out of cars, freezing or disarming them;
firing the payout and item events ("money exploits") of popular scripts;
unusual gains of money or items;
cars that take no damage under gunfire (vehicle godmode);
chat messages or names with HTML/JavaScript that runs on the other players' screens.

Contextual movement and godmode confirmation

Noclip is not confirmed from distance alone. The decision combines displacement and speed with incompatible physical velocity and/or disabled collision, excludes vehicles, falling, ragdoll, attachments and world transitions, and requires consecutive strikes above a confidence threshold. Normal samples reduce confidence. Spawn/join, revive, authorized teleports, interiors and routing-bucket changes receive grace periods.

Godmode is not confirmed from an invincibility flag alone either. It requires server-observed incoming damage, repeated health/armour samples with no decrease, and a minimum accumulated damage amount. Death, revive, grace periods and authorized temporary permissions clear the sequence. Evidence includes the values and context that contributed to the confidence score.

Learning mode

On each server's page there is a switch for learning mode. While it is on, SafeGuard detects, scores and reports everything as usual but punishes nobody automatically: every punishment is recorded as "what the rules would have done".

The report, which stays after you switch it off, shows, for each detection type, how many players it flagged:

Noisy: flags 10 % or more of the players. On your server that is almost always normal play (a racing script, a map with jumps). SafeGuard suggests a more tolerant sensitivity that you apply with one click (it becomes a new configuration version, reversible in Rules).
Review: a few players. Look at them before automating.
Reliable: only isolated players, as real cheating usually is. Safe to let the rules act.

We recommend it for the first week after installing and whenever you add large scripts.

All detections

Category	Detection	Code	Weight
Integrity	Missed heartbeats	`integrity.heartbeat_missed`	4
Integrity	Heartbeat sequence gap	`integrity.heartbeat_gap`	3
Integrity	Replayed heartbeat	`integrity.heartbeat_replay`	15
Integrity	Challenge-response failed	`integrity.challenge_failed`	15
Integrity	Session token mismatch	`integrity.token_mismatch`	8
Integrity	Anticheat client absent	`integrity.client_absent`	10
Integrity	Client re-initialised	`integrity.repeated_hello`	8
Integrity	Telemetry flood	`integrity.telemetry_flood`	15
Integrity	Malformed telemetry	`integrity.malformed_telemetry`	10
Integrity	Client/server position mismatch	`integrity.position_mismatch`	10
Movement	Teleport	`movement.teleport`	10
Movement	Speed hack (on foot)	`movement.speed`	12
Movement	Noclip	`movement.noclip`	15
Movement	Fly	`movement.fly`	15
Movement	Super jump	`movement.super_jump`	10
Movement	Vehicle speed	`movement.vehicle_speed`	10
Movement	Invisible	`movement.invisible`	25
Movement	Health modifier	`movement.health_modifier`	35
Movement	Armor modifier	`movement.armor_modifier`	35
Movement	Blocked ped model	`movement.ped_change`	30
Movement	Spectate / freecam	`movement.spectate`	15
Movement	Driver seat taken from a distance	`movement.vehicle_hijack`	35
Movement	Godmode	`movement.godmode`	30
Movement	Vehicle that takes no damage	`movement.vehicle_godmode`	30
Weapons	Blacklisted weapon	`weapon.blacklisted`	45
Weapons	Weapon given to another ped	`weapon.give_other`	40
Weapons	Damage modifier	`weapon.damage_modifier`	25
Weapons	Rapid fire	`weapon.rapid_fire`	20
Weapons	Weapon not in the inventory	`weapon.not_in_inventory`	40
Combat	Impossible hit angle	`combat.impossible_angle`	20
Combat	Aim snap	`combat.aim_snap`	15
Combat	Abnormal headshot ratio	`combat.headshot_ratio`	20
Combat	Hit without line of sight	`combat.no_line_of_sight`	20
Combat	Hit beyond weapon range	`combat.out_of_range`	30
Combat	Many players hit at once	`combat.multi_target`	40
Combat	Damage with a weapon not in hand	`combat.weapon_mismatch`	35
Combat	Too many kills per minute	`combat.kill_rate`	20
Combat	Silent aim (hits with the aim beside the target)	`combat.silent_aim`	30
Combat	Aimbot (repeated snaps onto the target)	`combat.aimbot`	35
Combat	Taser from too far or in a loop	`combat.taser_abuse`	30
Combat	Melee hit from too far (kill player)	`combat.melee_range`	35
Entities	Blacklisted entity model	`entity.blacklisted_model`	35
Entities	Entity spam	`entity.spam`	30
Entities	Mass spawn	`entity.mass_spawn`	45
Entities	Car rain	`entity.vehicle_rain`	45
Entities	Blacklisted explosion	`entity.explosion_blacklisted`	40
Entities	Invisible / silent explosion	`entity.explosion_invisible`	40
Entities	Explosion spam	`entity.explosion_spam`	35
Entities	Remote explosion	`entity.explosion_remote`	35
Entities	Game event abuse	`entity.game_event_abuse`	25
Entities	Game events aimed at other players	`entity.player_tampering`	35
Entities	Objects attached to other players	`entity.attach_to_player`	35
Events	Honeypot event	`event.honeypot`	80
Events	Forbidden event	`event.forbidden`	50
Events	Exploit attempt on a script this server does not run	`event.exploit_probe`	40
Events	Sweep of exploit events on scripts this server does not run	`event.exploit_sweep`	100
Events	Event schema violation	`event.schema_violation`	15
Events	Event rate limit	`event.rate_limit`	10
Events	Event without permission	`event.permission`	20
Events	Event too far away	`event.distance`	15
Events	Event spam	`event.spam`	20
Events	HTML or script in chat	`event.markup_injection`	45
Events	Burst of many different events	`event.fanout`	40
Economy	Money spike	`economy.money_spike`	25
Economy	Economy limit exceeded	`economy.limit_exceeded`	30
Economy	Duplication	`economy.duplication`	40
Executor	Blacklisted command	`executor.blacklisted_command`	45
Executor	Unknown resource	`executor.unknown_resource`	35
Executor	Suspicious global	`executor.suspicious_global`	20
Executor	Anticheat resource stopped	`executor.resource_stopped`	20
Integrity	Godmode flag on the player (client)	`integrity.local_godmode`	15
Integrity	Thermal or night vision on foot	`integrity.vision_mode`	8
Integrity	Every player on the map (ESP blips)	`integrity.player_blips`	10
Movement	Camera far from the player (freecam)	`movement.freecam`	15
Movement	Vehicle power boost	`movement.vehicle_boost`	20

Weekly report

Every week the owners and admins get a summary by e-mail: detections, bans (automatic and manual), appeals waiting for a decision and the most suspicious players. Discord channels with the Weekly report event get it too. Turn it off in Settings.

False positives

If a detection fires for no reason:

Mark it as false positive on the detection's page.
If it keeps happening, lower its sensitivity in Rules → Detections.
For scripts that teleport players (garages, houses, jail), use the allowTeleport export (see Scripts and integrations).
Tell us on Discord with the detection code: it helps us tune the limits for everyone.

PreviousStaff tools NextEventShield