Free security scanner for FiveM resources
FXScan is static analysis for FiveM resource archives. Upload a resource and it reports whether code in it can reach out to the network and execute what comes back — before that resource ever runs on your server.
fxscan.cc
The pipeline has five stages and none of them execute anything from the archive: archive validation, safe extraction, manifest discovery, AST and taint analysis, and evidence generation.
Manifest-aware scanning parses fxmanifest.lua declaratively to establish whether suspicious code runs server-side, client-side, or not at all. The same pattern in a server script and in a file the runtime never loads are not the same finding, and the report reflects that.
Remote execution tracing separates a benign HTTP request from a malicious chain — request, decode, load — and shows the complete data-flow path with file locations and line numbers, so you can verify the finding yourself instead of trusting a score.
Findings with evidence: the file, the line, and each hop from the network source to the execution sink. Where a remediation is possible, FXScan generates a patch suggestion with a diff and an impact assessment for you to review before applying.
And an explicit statement of limits. A clean report is evidence, not a guarantee: static analysis reasons about code as shipped, cannot know what a remote endpoint will return next month, and reports escrow-encrypted archives as not analysable rather than clean.
Before installing a purchased resource
Ten seconds of scanning before the code has your database credentials, instead of an incident afterwards.
After an update
The version you reviewed is not the version an auto-updater installed. Re-scan on every change.
During an incident
Analysis works on the archive with no server access, which matters precisely when you cannot trust the machine.
There is a free tier of three scans a month, which covers occasional resource review. An account is required to use the service.
No. Analysis runs on the uploaded resource archive, which is the point — you review the code before it ever reaches your server. FXScan never connects to your server and does not need to.
No. All five stages of the pipeline are non-executing: validation, extraction, manifest discovery, AST and taint analysis, and evidence generation. Nothing from the archive is executed at any point.
No, and it does not claim to. A clean report means no known-bad pattern and no traceable path from a network source to code execution was found in the code as shipped. It cannot know what a remote server will return in future, and it reports unreadable archives as not analysable rather than clean.
A practical review process for FiveM resources: what to unpack, which files to read first, the patterns that matter, and where automated scanning helps.
The recurring shapes of FiveM backdoors — remote loaders, config-hidden URLs, ace grants, event backdoors — and the detection logic for each.
What to do in the first hour after a FiveM compromise: contain, preserve evidence, rotate credentials, find the entry point and rebuild safely.
Report threats, contribute detections, participate in research or build open-source tooling with the Titan community.