Detections
Risk instead of bans on one flag
Each detection has a weight and a confidence. The player's risk (0–100) adds these up per category and decays over time. Weak or ambiguous detections (missed heartbeats, a single combat sample) are capped per sample, so a single occurrence never reaches a punishment.
- Server signals (positions, entities, damage, events, money) are the basis of decisions.
- Client signals (menu commands, injected resources, spectator mode) count half and never lead to an automatic ban on their own.
- When staff mark detections as false positive or confirmed, SafeGuard adjusts that type's weight on your server (after 20 verdicts).
Against cheat menus
The most used menus (Eulen, Skript, and Lua menus executed through them) change all the time to avoid being recognised on the player's computer. That is why SafeGuard focuses on what they do on the server, which is the same whatever the menu:
- teleporting, flying, noclip (also with collision off), super jump, speed, invisibility;
- godmode (damage that does not lower health), health and armour above the maximum;
- killing or tazing players with weapons not in hand, shooting through walls, aimbot;
- exploding players from far away, invisible or spammed explosions;
- dropping huge props, spawning dozens of entities, huge particle effects;
- pulling players out of cars, freezing or disarming them;
- firing the payout and item events ("money exploits") of popular scripts;
- unusual gains of money or items.
All detections
| Category | Detection | Code | Weight |
|---|---|---|---|
| Integrity | Missed heartbeats | integrity.heartbeat_missed | 4 |
| Integrity | Heartbeat sequence gap | integrity.heartbeat_gap | 3 |
| Integrity | Replayed heartbeat | integrity.heartbeat_replay | 15 |
| Integrity | Challenge-response failed | integrity.challenge_failed | 15 |
| Integrity | Session token mismatch | integrity.token_mismatch | 8 |
| Integrity | Anticheat client absent | integrity.client_absent | 10 |
| Integrity | Client re-initialised | integrity.repeated_hello | 8 |
| Integrity | Telemetry flood | integrity.telemetry_flood | 15 |
| Integrity | Malformed telemetry | integrity.malformed_telemetry | 10 |
| Integrity | Client/server position mismatch | integrity.position_mismatch | 10 |
| Movement | Teleport | movement.teleport | 10 |
| Movement | Speed hack (on foot) | movement.speed | 12 |
| Movement | Noclip | movement.noclip | 15 |
| Movement | Fly | movement.fly | 15 |
| Movement | Super jump | movement.super_jump | 10 |
| Movement | Vehicle speed | movement.vehicle_speed | 10 |
| Movement | Invisible | movement.invisible | 25 |
| Movement | Health modifier | movement.health_modifier | 35 |
| Movement | Armor modifier | movement.armor_modifier | 35 |
| Movement | Blocked ped model | movement.ped_change | 30 |
| Movement | Spectate / freecam | movement.spectate | 15 |
| Movement | Driver seat taken from a distance | movement.vehicle_hijack | 35 |
| Movement | Godmode | movement.godmode | 30 |
| Weapons | Blacklisted weapon | weapon.blacklisted | 45 |
| Weapons | Weapon given to another ped | weapon.give_other | 40 |
| Weapons | Damage modifier | weapon.damage_modifier | 25 |
| Weapons | Rapid fire | weapon.rapid_fire | 20 |
| Weapons | Weapon not in the inventory | weapon.not_in_inventory | 40 |
| Combat | Impossible hit angle | combat.impossible_angle | 20 |
| Combat | Aim snap | combat.aim_snap | 15 |
| Combat | Abnormal headshot ratio | combat.headshot_ratio | 20 |
| Combat | Hit without line of sight | combat.no_line_of_sight | 20 |
| Combat | Hit beyond weapon range | combat.out_of_range | 30 |
| Combat | Many players hit at once | combat.multi_target | 40 |
| Combat | Damage with a weapon not in hand | combat.weapon_mismatch | 35 |
| Combat | Too many kills per minute | combat.kill_rate | 20 |
| Entities | Blacklisted entity model | entity.blacklisted_model | 35 |
| Entities | Entity spam | entity.spam | 30 |
| Entities | Mass spawn | entity.mass_spawn | 45 |
| Entities | Blacklisted explosion | entity.explosion_blacklisted | 40 |
| Entities | Invisible / silent explosion | entity.explosion_invisible | 40 |
| Entities | Explosion spam | entity.explosion_spam | 35 |
| Entities | Remote explosion | entity.explosion_remote | 35 |
| Entities | Game event abuse | entity.game_event_abuse | 25 |
| Entities | Game events aimed at other players | entity.player_tampering | 35 |
| Entities | Objects attached to other players | entity.attach_to_player | 35 |
| Events | Honeypot event | event.honeypot | 80 |
| Events | Forbidden event | event.forbidden | 50 |
| Events | Exploit attempt on a script this server does not run | event.exploit_probe | 40 |
| Events | Event schema violation | event.schema_violation | 15 |
| Events | Event rate limit | event.rate_limit | 10 |
| Events | Event without permission | event.permission | 20 |
| Events | Event too far away | event.distance | 15 |
| Events | Event spam | event.spam | 20 |
| Events | Burst of many different events | event.fanout | 40 |
| Economy | Money spike | economy.money_spike | 25 |
| Economy | Economy limit exceeded | economy.limit_exceeded | 30 |
| Economy | Duplication | economy.duplication | 40 |
| Executor | Blacklisted command | executor.blacklisted_command | 45 |
| Executor | Unknown resource | executor.unknown_resource | 35 |
| Executor | Suspicious global | executor.suspicious_global | 20 |
| Executor | Anticheat resource stopped | executor.resource_stopped | 20 |
False positives
If a detection fires for no reason:
- Mark it as false positive on the detection's page.
- If it keeps happening, lower its sensitivity in Rules → Detections.
- For scripts that teleport players (garages, houses, jail), use the
allowTeleportexport (see Scripts and integrations). - Tell us on Discord with the detection code: it helps us tune the limits for everyone.