Scripts and integrations

Exports for your scripts

Your server scripts can talk to SafeGuard through exports (server side only; players cannot call them). For temporary permissions, explicitly allow your resource names in Config.MovementPermissionResources in config.lua. No external resource is trusted by default. Durations are in milliseconds with an optional reason; maximums are 60 s for teleport/godmode, 120 s for movement, and 30 s for revive. Invalid durations and calls from unauthorized resources are rejected.

-- Before the action (garage, hospital, spawn, interior, admin): mark the legitimate transition.
exports.safeguard:allowTeleport(source, 5000, 'garage') -- up to 60 s
exports.safeguard:allowGodmode(source, 15000, 'hospital-protection')
exports.safeguard:allowMovement(source, 10000, 'admin-sequence') -- noclip/speed/fly/teleport

-- Revive briefly authorizes transition movement and invincibility (maximum 30 s).
exports.safeguard:allowRevive(source, 20000, 'ambulance-revive')

-- `grace` remains for older scripts; it authorizes movement only, for at most 120 s.
exports.safeguard:grace(source, 10000, 'cutscene')

-- Payouts: SafeGuard refuses amounts above the limit and while quarantined.
local ok = exports.safeguard:economyTransaction(source, 'bank', 5000, 'job:trucker')
if ok then xPlayer.addAccountMoney('bank', 5000) end

-- Read the player's state.
local quarantined = exports.safeguard:isQuarantined(source)
local risk = exports.safeguard:getRisk(source)     -- { global = 12.5, level = 'normal' }

-- One of your scripts noticed something suspicious (never treated as server proof).
exports.safeguard:reportDetection(source, 'economy.money_spike', 0.7, { amount = 1000000 })

Permissions are server-side, player-scoped, recorded with resource/reason and expire automatically; there is no network event a client can use to request a bypass. Declare the permission immediately before the action and use the shortest duration that works.

Discord alerts

In Integrations → Discord alerts add the webhook of a staff channel and pick the events: critical threats, bans, high-risk players, servers offline, license expiring, critical scanner findings, staff actions, new ban appeals and the weekly report. Without the cloud, set the webhook in server.cfg:

set safeguard_discord_webhook "https://discord.com/api/webhooks/…"

API keys

In Integrations → API keys you create keys with limited permissions, for your own tools or the Discord bot. The key is shown once; revoke it if it leaks.

Resource scanner and Discord bot

The scanner checks your resources folder for backdoors, obfuscated code, exposed webhooks and unprotected events, and uploads only the findings (never your code) to the Scanner page. The Discord bot brings /player, /ban, /unban, /server, /detections and /screenshot to your staff.

See how to use the scanner in Resource scanner.