Resource scanner
The scanner reads your server's resources folder and tells you which scripts have security problems. It runs on your machine, and the report sent to the dashboard carries only the findings, never your code.
Use it after installing new scripts, before updating the server and whenever you buy a script you did not write.
What it looks for
| Problem | Why it matters |
|---|---|
| Backdoors and remote code execution | They give full control of the server to whoever planted them |
| Obfuscated code | It often hides backdoors or license stealers |
| Discord webhooks and credentials in the code | They can be read and abused |
| Events where the client picks the amount, price or target | They allow money generation or acting on other players |
| Sensitive events without a permission check | Any player can call them |
| SQL built from client input | It allows reading or changing the database |
| Events without EventShield | Shows how many events are exposed |
Before you start
- Ask for the scanner on Discord: it is handed out on request.
- Install Node.js 24 or newer on the machine that holds the resources.
- In Integrations → API keys, create a key with the scanner permissions. Copy it right away: it only shows once.
- Copy the organization ID. It is the code after
/o/in the dashboard address.
Scan and send the report
To only see the results in the terminal:
safeguard-scan scan ./resources
To see them in the dashboard, under Operations → Scanner:
safeguard-scan scan ./resources --upload --api https://api.safeguardac.pt --org ORGANIZATION_ID --key YOUR_KEY
If the machine cannot send anything, save the report to a file and load it in the dashboard with Upload report:
safeguard-scan scan ./resources --out report.json
That file includes the line of code of each finding, which can hold a webhook or a password. Do not share it.
To keep the key out of your terminal history, set it in the SAFEGUARD_API_KEY variable and leave out --key.
On the monthly plan, each upload counts toward the limit of 5 scans per month. Scanning without uploading does not.
Reading the results
- Security Score: goes from 0 to 100. Compare it between scans to see if things improve, rather than treating it as an absolute grade.
- Severity: start with critical and high. A critical finding can mean an active backdoor.
- Fix: each finding gives the file, the line, the impact and what to do.
- Status: mark each finding as Open, Acknowledged, Fixed or False positive.
What to do with each kind:
- A backdoor or obfuscated code you do not recognise: remove the resource, do not try to fix it. Change the passwords and keys that server used.
- Webhooks and credentials: create new ones at the source. Deleting them from the code is not enough, because the old ones may already be copied.
- Unsafe events: fix the script or talk to its author. Validation has to happen on the server.
- After fixing: run the scanner again and confirm the finding is gone.
Protecting events with EventShield
The report shows how many events are protected. To add EventShield to the resources that have events, first see what would change:
safeguard-scan install-shield ./resources
If it looks right, apply it. Each changed manifest keeps a .safeguard-backup copy:
safeguard-scan install-shield ./resources --apply
Then restart those resources. Try it on a test server before applying it in production.
Limits
- It is static analysis: it reads the code without running it, so it can give false positives and miss well-hidden problems.
- Compiled or obfuscated code cannot be read in full. A clean report does not prove a script is safe.
- The scanner does not replace the anticheat: it checks your scripts, not your players.
Using it in automation
The command exits with code 2 when there are critical findings, so it can stop a deploy. With --strict-eventshield it can also fail on event coverage. --json prints the report to the terminal and --server links it to a server.