> For the complete documentation index, see [llms.txt](https://sbscripts.gitbook.io/sb-scripts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sbscripts.gitbook.io/sb-scripts/sb-anticheat/trusted-resources.md).

# Trusted Resources

Sometimes one of your own scripts has a good reason to do something the anticheat dislikes, such as an admin menu that makes you invisible, a job script that teleports you, or a revive that changes health. Whitelisting the whole player is too much. `AllowDetection` gives one player a short bypass for one detection category.

### Two ways to use it

**1. The export.** Any resource can call it right before the action:

```lua
exports["sbanticheat"]:AllowDetection("teleport", 5)               -- client script
exports["sbanticheat"]:AllowDetection("teleport", 5, playerSrc)    -- server script
```

No config change is needed. To allow only certain resources, set `allowAnyResource = false` and list them in `shared/trustedresource.lua`.

**2. The list.** If you can't edit the other script, list it in `shared/trustedresource.lua`:

```lua
SB.trustedResources = {
    ['tk_drugs']     = { invisibility = true },
    ['my_adminmenu'] = { invisibility = true, teleport = true, noclip = true },
}
```

When a detection in one of those categories fires while the listed resource is running, SB AntiCheat exempts that player for a short window (`autoExemptSeconds`, 10 by default) instead of punishing straight away. It renews while the detection keeps firing, up to `autoExemptMaxSeconds` (60 by default). After that, normal punishment applies.

> ⚠️ SB AntiCheat can't tell which resource caused the detection. While a listed resource is running, a cheater using the same category gets the same short window. Keep the list small, and make sure the key matches the real resource folder name.

### Categories

| Category       | Detections it quiets                      |
| -------------- | ----------------------------------------- |
| `invisibility` | Invisible                                 |
| `teleport`     | Teleport, VehicleTeleport, ServerTeleport |
| `godmode`      | GodMode, GodmodeSync                      |
| `health`       | HealthIncrease                            |
| `armor`        | ExcessArmour                              |
| `noclip`       | NoClip, VehicleNoClip                     |

### How it behaves

* **The caller is identified by FiveM.** The resource name comes from `GetInvokingResource()`. Arguments you pass are not trusted for this.
* **One player, one category.** Other players and other detections are not affected.
* **It expires by itself.** A single bypass never lasts longer than `maxDuration`.
* **Renewing is capped.** One continuous bypass can't run longer than `maxContinuous` (60 seconds by default), so it can never become permanent.
* **Refused calls explain why.** The reason is printed to the F8 console (client) or the server console. `sb trust` in the server console lists active bypasses.
* **Everything else is unchanged.** Logging and punishment still apply to anything not exempt.

### Settings

```lua
SB.trustedSettings = {
    allowAnyResource = true,    -- false = only listed resources may use the export
    autoExempt       = true,    -- false = turn off the automatic list behaviour
    autoExemptSeconds    = 10,  -- length of each automatic window
    autoExemptMaxSeconds = 60,  -- most seconds in total before normal punishment
    maxDuration      = 15,      -- longest single bypass, in seconds
    maxContinuous    = 60,      -- longest a renewed bypass can run, in seconds
    capPause         = 3,       -- forced gap after that, in seconds
    cooldown         = 0,
    maxClientRequestsPerMinute = 20,
    maxClientBypassSecondsPerMinute = 30,
}
```

### Server or client?

The server export is stronger. The server checks the calling resource and needs the player ID. The client export needs no player ID and also informs the server, but client requests are rate limited and capped because a client can never be fully trusted. If you are worried about cheat code running inside one of your resources, set `allowAnyResource = false`.