How to report a vulnerability or a malicious resource in the FiveM ecosystem
In short
To report a security issue in the FiveM ecosystem, send it to the affected party first and publicly second. A useful report contains the affected resource and version, a description of the impact in one sentence, the minimal steps or code path that demonstrate it, and how you would like to be credited. Give the maintainer a reasonable window — 90 days is the common norm, shorter if the issue is being actively exploited — and coordinate a public advisory rather than publishing an exploit. If the affected party is unreachable or unresponsive, escalate to a coordinating third party. Titan Software accepts reports at [email protected] for our own systems, and accepts malicious resource samples through the same channel so that detections benefit everyone.
Key takeaways
- Report to the maintainer before the public. The goal is a fix, not an audience.
- A good report is reproducible: version, impact, minimal path, and the file and line if you have it.
- Do not test on servers you do not operate. Read the archive instead of attacking a live system.
- Ninety days is the usual disclosure window; active exploitation justifies moving faster.
- If the maintainer is unreachable, escalate rather than publish — and never publish a working exploit.
Finding a backdoor in a widely used resource, or a flaw in a framework thousands of servers run, puts you in an awkward position. Say nothing and the problem persists. Say everything publicly and you have handed a working attack to everyone before a fix exists. Coordinated disclosure is the well-worn path between those, and it is not complicated.
Where to send it
- 1The maintainer or vendor of the affected resource, through whatever private channel they publish — a security email, a private issue, a support ticket. Always first.
- 2The platform, if the resource is distributed through a marketplace whose rules it violates.
- 3A coordinating third party if the maintainer is unreachable, unresponsive, or is themselves the problem — which is exactly the case for a deliberately backdoored resource.
- 4The affected server operators, if a specific server is compromised and you can reach them directly.
What a useful report contains
Maintainers triage on clarity. A report that takes five minutes to understand gets fixed; a report that takes an hour to reproduce sits in a queue.
| Field | What to write |
|---|---|
| Affected artefact | Resource name, exact version, and where you obtained it |
| Impact | One sentence: what an attacker gains. 'Any client can execute arbitrary Lua on the server.' |
| Evidence | File and line, or the minimal code path. For a backdoor, the data flow from source to sink. |
| Reproduction | The smallest sequence that demonstrates it, on your own test server |
| Scope | How many servers are plausibly affected, if you can estimate it honestly |
| Disclosure intent | Your proposed timeline and whether you want credit |
Attach the original archive when reporting a malicious resource. The unmodified file is the artefact everything else is derived from — hashes, detections, comparison against re-uploads.
The rules that keep this legitimate
- Test only on infrastructure you own or have written permission to test. Curiosity is not authorisation, and a live server is someone's property.
- Read code rather than attacking systems. Almost every FiveM finding can be established from the archive alone.
- Do not access, copy or retain other people's data. If you encounter it accidentally, say so in the report and delete it.
- Do not extort. Asking for a bounty a vendor advertises is fine; conditioning disclosure on payment is not.
- Do not publish working exploits. Describe the class of problem, not the recipe.
Timelines that work in practice
- 1
Day 0 — report privately
Send the report and ask for acknowledgement within a week. State your intended disclosure date up front so nobody is surprised later.
- 2
Day 7 — escalate if silent
No acknowledgement means try another channel: a second contact, the platform, or a coordinating party. Silence is common and usually means the message was missed, not ignored.
- 3
Day 30–90 — coordinate the advisory
Agree what will be published, when, and who is credited. A joint advisory that lands with the fix serves everyone better than a race.
- 4
Faster when exploitation is active
If servers are being compromised right now, the calculus changes: operators need enough information to defend themselves immediately, even without a fix. Publish mitigations, not exploits.
What we do with a report
We are a registered association, so how we handle reports is a matter of published policy rather than goodwill. For a sample of a malicious resource, the sequence is: acknowledge, verify the finding independently, build a detection, notify the affected maintainer or platform where one exists, and publish an advisory once the exposure is reduced. Where a detection can be shared openly, it is — a finding that only protects our users leaves the ecosystem where it was.
See the reporting channelsReport a threat, submit a sample, or read our responsible disclosure policy.If you are hesitating because you are not sure the finding is real: send it anyway, with your uncertainty stated. A report that turns out to be a false alarm costs an hour. A finding that goes unreported because someone felt unqualified costs whichever servers it eventually reaches.
Frequently asked questions
How do I report a malicious FiveM resource?
Report it privately first — to the maintainer if there is a legitimate one, to the marketplace if it is distributed there, and to a coordinating party such as Titan Software if the author is the problem. Include the resource name, exact version, where you obtained it, the file and line demonstrating the malicious behaviour, and the original unmodified archive. Send samples to [email protected].
Is it legal to test a FiveM server for vulnerabilities?
Only with the operator's permission. Unauthorised access to a computer system is a criminal offence in the Czech Republic and across the EU, and good intentions are not a legal defence. Analysing a resource archive you legitimately obtained is a different activity entirely and is where almost all FiveM security findings come from anyway.
How long should I wait before publishing a FiveM security finding?
Ninety days after a private report is the widely used norm, agreed with the maintainer where possible. Move faster when the issue is being actively exploited and operators need to defend themselves immediately — but publish mitigations and a description of the problem class, not a working exploit.