Engineering a safer FiveM ecosystem.

Titan Software z.s. is a Czech registered association (zapsaný spolek, IČO 29738725) that builds security infrastructure for the FiveM ecosystem. It operates three products in production — Titan AC (anti-cheat), CFXR (FiveM server resolver) and FXScan (static analysis for FiveM resources) — and develops Titan Security, a shared layer of threat reporting, analysis and open detections. Being an association rather than a company is why its statutes, structure, code of conduct and disclosure policy are published documents.

Review it before it reaches your server: unpack the archive without running it, read fxmanifest.lua to see which files load and on which side, then search the loaded files for outbound network calls, decoding routines, dynamic code loading (load, loadstring) and permission grants (add_ace, add_principal). A traceable path from a network response through a decoder into load() is remote code execution. FXScan performs the same analysis automatically and reports the path with file names and line numbers.

FXScan has a free tier of three scans a month, which covers occasional resource review. An account is required. It analyses the resource archive you upload and never needs access to your FiveM server, because the whole point is reviewing code before it reaches the server.

CFXR (cfxr.cc) is free and requires no account. Paste a FiveM join URL or a CFX code and it resolves the server's connection endpoint, the network that endpoint belongs to, the resources the server advertises, its server variables and its live player data. All of that is information the server publishes so clients can connect — CFXR does not access the server.

No. Static analysis reasons about code as shipped: it cannot know what a remote endpoint will return next month, cannot resolve every runtime-constructed string, and reports escrow-encrypted archives as not analysable rather than clean. A clean report is evidence that no known-bad pattern and no traceable execution path was found — useful evidence, but not a guarantee. Re-scan on every update.

No; these are different problems. An anti-cheat such as Titan AC watches player behaviour and client integrity. A backdoor is malicious code inside a resource the operator installed deliberately, running with the server's own privileges. Resource-level threats need static analysis of the archive before installation and re-checking whenever it updates.

Write to [email protected] with the resource name, exact version, where you obtained it, and the original unmodified archive. Report privately first — to the maintainer where there is a legitimate one, to the marketplace where it is distributed, and to us when the author is the problem. Our responsible disclosure policy is published as a document on this site.

Titan AC, CFXR and FXScan are in production and usable now. Titan Security Cloud and the Titan Security portal are in development, and are labelled that way everywhere on this site. We mark development status honestly rather than presenting a roadmap as a shipped product.