To check a FiveM resource for a backdoor, review it before it ever reaches your server: unzip the archive somewhere isolated, read fxmanifest.lua to learn which files actually load and on which side, then search every loaded file for the four things a backdoor needs — an outbound network call, a decoding step, a dynamic code loader such as load or assert(load(...)), and an identity or permission grant. A resource that combines a network fetch with load() is remote code execution by design, no matter how the seller describes it. Automated static analysis such as FXScan performs the same review in seconds and shows the data-flow path with file names and line numbers, but a clean report is evidence, not a guarantee.