Find backdoors in FiveM resources before installation.
Upload a resource archive and inspect suspicious code paths, remote execution chains and unsafe network behaviour — with the evidence behind every finding.
Three scans a month, free · Source code is parsed, never executed
What it looks for
Three questions the scanner answers about an archive you were about to install.
Remote execution tracing
Tells a benign PerformHttpRequest apart from request → decode → load(), and shows the chain with file and line.
Manifest-aware scanning
Reads fxmanifest.lua declaratively, so every finding knows whether the file runs on the server, the client, or never.
Actionable remediation
Proposes a patch with a diff and an impact statement. Nothing is applied until you accept it.
How the analysis works
Five stages, none of which run the code they are reading.
- 01
Archive validation
Traversal, symlinks, ratio and entry count, before a byte is written.
- 02
Safe extraction
Streamed against hard byte budgets, so a ZIP bomb dies mid-flight.
- 03
Manifest discovery
Every resource found from its manifest, parsed and never executed.
- 04
AST and taint analysis
Tree-sitter syntax trees, then untrusted data followed to dangerous sinks.
- 05
Evidence generation
Findings with file, line, excerpt and the data-flow chain behind them.
What it cannot do
- This is static analysis. A resource can still behave maliciously in ways no static analyser can observe.
- Escrow-protected .fxap files are encrypted and cannot be read. The report says so rather than staying silent.
- Obfuscation is flagged but is not proof of malice - though it does hide behaviour.
- Nested archives are reported and never unpacked.
A clean report is evidence, not a guarantee. Review anything that will run on your server.
Common questions
What the scan does with your archive, who can read the result, and what it does not claim.
- Is uploaded code executed?
- No. Analysed code is read, hashed and parsed into a syntax tree. There is no eval, no load of an analysed file, no child process, no manifest evaluation, and no outbound request to any URL found inside the archive.
- Who can see my scan reports?
- Only the account that created them. Reports are private by default and cannot be opened by guessing a link or knowing an id. You can create a revocable read-only share link if you want to show one to somebody.
- Does a clean report mean the resource is safe?
- No. It means no rule matched. Static analysis proves the presence of a pattern, never its absence: a resource can be malicious in a way no rule covers yet. Read the report's stated limits and review anything that will run on your server.
- What languages does it analyse?
- Lua, JavaScript and TypeScript, parsed into real syntax trees. Native binaries and precompiled Lua bytecode are recorded as unreadable rather than analysed, which is itself reported.
- Why does it not flag every PerformHttpRequest or load() call?
- Because that would be noise. Plenty of legitimate resources make HTTP requests, and load() has real uses. A finding requires a data-flow path from untrusted input to a dangerous sink - the chain, not the individual call.
- How large an archive can it handle?
- Upload size, extracted size and file count are all capped by the deployment's configuration, and an archive that exceeds a limit is rejected rather than partially analysed.
Read more
How malicious FiveM resources are actually built, and the full rule catalogue.