devtoolsgg.com
Guides
GuidesFiveMFiveMGarry's ModMinecraftShared
Shared

Identity

  • SteamID
  • joaat hash

Formatting

  • JSON and Lua
  • Encoding
  • Colours

Security

  • Secrets
  • Security linter
devtoolsgg.com

Generators for game server owners

Platforms

  • FiveM
  • Garry's Mod
  • Minecraft
  • Shared

Resources

  • Home
  • llms.txt

Social

  • Coming soon.

© 2026 devtoolsgg.com

Not affiliated with, endorsed by or associated with Cfx.re, Rockstar Games, Facepunch Studios, Mojang, Microsoft or Valve. All trademarks belong to their respective owners.

  1. Shared
  2. Security
  3. Security linter

Security Linter

Paste server-side Lua and get the dangerous patterns flagged: events that trust the client, dynamic code execution, concatenated SQL and leaked secrets. Every finding explains the fix.

optional

Narrows the rules to one engine, or runs everything.

required

Paste a file or the handler you are unsure about.

Nothing is uploaded, the review runs entirely in your browser.
1Generated with devtoolsgg.com2-- SUMMARY -------------------------------------------------------------3Lines reviewed: 84[!] 2 high   [-] 0 medium   [.] 0 low56-- HIGH (2) ------------------------------------------------------------78[!] Net event registered, make sure the handler re-checks everything9    line 110    > RegisterNetEvent("shop:buy")1112    Any player can trigger a registered net event with any arguments.13    Inside the handler, take `source` as the only trustworthy value:14    never accept an identifier, a price, a job or an amount from the15    payload without re-reading it server-side.1617[!] Money or item amount taken straight from the caller18    line 619    > xPlayer.removeMoney(price)2021    If this amount arrives from a client event, a player can send any22    number they like. Look the price up server-side from your own config23    table and ignore the client's number entirely.2425-- NOTE ----------------------------------------------------------------26Pattern matching, not a proof. It cannot see whether a value really came27from a client, so keep reading your own handlers.28
report28 lines, 1098 characters

Related tools

Secrets