#

FiveM Security Scan Report
**Generated:** 1/22/2026, 9:40:28 PM
---
##

Summary
| Metric | Count |
|--------|-------|
| Files Scanned | 108 |
|

Critical | 0 |
|

High | 1 |
|

Medium | 0 |
|

Suspicious | 2 |
|

Low | 126 |
| **Total Threats** | **129** |
---
##

Detailed Findings
###

`vms_housing/client/functions.lua`
**Severity:** LOW | **Threats:** 2
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 2
- **Lines:** 733, 804
```lua
FreezeEntityPosition(PlayerPedId(), true)
```
---
###

`vms_housing/client/init.lua`
**Severity:** LOW | **Threats:** 2
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 2
- **Lines:** 92, 96
```lua
-- Check if player is at shell height (around z=500)
local playerCoords = GetEntityCoords(PlayerPedId())
if playerCoords.z > 450 and playerCoords.z < 550 then
```
---
###

`vms_housing/client/lib.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 280
```lua
function library.SpawnProp(model, coords, networked, attachData, disableCollision, dynamicEntity)
local playerPed = PlayerPedId()
local modelHash = tonumber(model) or GetHashKey(model)
```
---
###

`vms_housing/client/main.lua`
**Severity:** LOW | **Threats:** 17
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 17
- **Lines:** 172, 230, 231, 232, 238, 253, 254, 277, 302, 308, 650, 666, 694, 695, 1137, 1419, 1420
```lua
Wait(1500)
FreezeEntityPosition(PlayerPedId(), true)
```
---
###

`vms_housing/client/modules/cctv.lua`
**Severity:** LOW | **Threats:** 2
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 2
- **Lines:** 68, 226
```lua
-- Restore player
local playerPed = PlayerPedId()
SetFocusEntity(playerPed)
```
---
###

`vms_housing/client/modules/creator.lua`
**Severity:** LOW | **Threats:** 31
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 31
- **Lines:** 174, 204, 420, 469, 596, 688, 719, 758, 807, 813, 963, 1350, 1352, 1373, 1381, 1385, 1417, 1419, 1430, 1438, 1442, 1710, 1784, 1978, 2023, 2155, 2249, 2634, 2734, 2773, 2827
```lua
RenderScriptCams(true, true, 500, true, true)
FreezeEntityPosition(PlayerPedId(), true)
```
---
###

`vms_housing/client/modules/furniture.lua`
**Severity:** HIGH | **Threats:** 20
####

Native Invoke Abuse
- **Severity:** high
- **Description:** Direct native calls - may bypass security
- **Occurrences:** 1
- **Lines:** 406
```lua
-- Call native gizmo (0xEB2EDCA2)
local gizmoResult = Citizen.InvokeNative(
0xEB2EDCA2,
```
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 19
- **Lines:** 102, 122, 276, 277, 325, 329, 330, 343, 360, 385, 434, 437, 525, 768, 833, 994, 995, 1009, 1010
```lua
local playerPed = PlayerPedId()
local coords = GetEntityCoords(playerPed)
```
---
###

`vms_housing/client/modules/polyzone.lua`
**Severity:** LOW | **Threats:** 3
####

Infinite Loop Risk
- **Severity:** low
- **Description:** Infinite loop without Wait() - will freeze server
- **Occurrences:** 1
- **Lines:** 331
```lua
while true do
local playerPed = PlayerPedId()
```
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 2
- **Lines:** 282, 332
```lua
RegisterCommand("getRegion", function()
local coords = GetEntityCoords(PlayerPedId())
local region = library.GetCurrentRegion(coords.xyz) or "None"
```
---
###

`vms_housing/client/modules/property.lua`
**Severity:** LOW | **Threats:** 7
####

Infinite Loop Risk
- **Severity:** low
- **Description:** Infinite loop without Wait() - will freeze server
- **Occurrences:** 1
- **Lines:** 1214
```lua
-- Wait for exit key
while true do
DisableAllControlActions(0)
```
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 6
- **Lines:** 409, 602, 603, 1120, 1239, 1272
```lua
library.PlayAnimation(
PlayerPedId(),
"anim@scripted@ulp_missions@empty_crate@male@",
```
---
###

`vms_housing/client/modules/prop_shooter.lua`
**Severity:** LOW | **Threats:** 4
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 4
- **Lines:** 163, 168, 223, 225
```lua
-- Save player's original position
playerOriginalPosition = GetEntityCoords(PlayerPedId())
```
---
###

`vms_housing/client/modules/target.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 212
```lua
local ped = PlayerPedId()
local property = propertyId and Properties[propertyId] or GetCurrentPropertyData()
```
---
###

`vms_housing/client/nui.lua`
**Severity:** LOW | **Threats:** 16
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 16
- **Lines:** 131, 191, 235, 254, 547, 553, 567, 572, 589, 592, 804, 808, 880, 884, 1022, 1023
```lua
if houseConfiguration.previousCoords and houseConfiguration.previousCoords.x then
SetEntityCoords(PlayerPedId(), houseConfiguration.previousCoords.xyz)
end
```
---
###

`vms_housing/config/config.client.lua`
**Severity:** LOW | **Threats:** 6
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 6
- **Lines:** 384, 386, 430, 459, 480, 509
```lua
if Config.Core == "ESX" then
return ESX.Game.GetPlayersInArea(GetEntityCoords(PlayerPedId()), 5.0)
elseif Config.Core == "QB-Core" then
```
---
###

`vms_housing/config/config.server.lua`
**Severity:** SUSPICIOUS | **Threats:** 2
####

Raw SQL Query
- **Severity:** suspicious
- **Description:** Long raw SQL query - verify it uses parameterized values
- **Occurrences:** 2
- **Lines:** 160, 176
```lua
local updatedAccountsJson = json.encode(accounts)
MySQL.Async.execute('UPDATE `users` SET accounts = @accounts WHERE `identifier` = @identifier', {
['@accounts'] = updatedAccountsJson,
```
---
###

`vms_housing/integration/[garages]/cd_garage/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/integration/[garages]/jg-advancedgarages/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/integration/[garages]/loaf_garage/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/integration/[garages]/okokGarage/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/integration/[garages]/rcore_garage/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/integration/[garages]/RxGarages/client.lua`
**Severity:** LOW | **Threats:** 1
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 1
- **Lines:** 6
```lua
function OpenGarage(propertyId, propertyData)
local myPed = PlayerPedId()
local myVehicle = GetVehiclePedIsIn(myPed, false)
```
---
###

`vms_housing/server/main.lua`
**Severity:** LOW | **Threats:** 8
####

Infinite Loop Risk
- **Severity:** low
- **Description:** Infinite loop without Wait() - will freeze server
- **Occurrences:** 1
- **Lines:** 406
```lua
while true do
-- Only run if delivery type requires processing
```
####

Missing Distance Check
- **Severity:** low
- **Description:** No distance check on expensive operation
- **Occurrences:** 6
- **Lines:** 59, 3270, 3354, 3378, 3400, 3451
```lua
local playerPed = GetPlayerPed(playerId)
local player = SV.GetPlayer(playerId)
```
####

Disabled Security Check
- **Severity:** low
- **Description:** Security checks commented out
- **Occurrences:** 1
- **Lines:** 3996
```lua
-- If requester is renter, check they can't remove sensitive permissions
if not isOwner then
```
---
###

`vms_housing/server/modules/kq_shellbuilder.lua`
**Severity:** LOW | **Threats:** 1
####

Infinite Loop Risk
- **Severity:** low
- **Description:** Infinite loop without Wait() - will freeze server
- **Occurrences:** 1
- **Lines:** 18
```lua
-- Wait until resource is started or timeout
while true do
local resourceState = GetResourceState("kq_shellbuilder")
```
---
##

Report Information
- **Tool:** FiveM Backdoor Scanner v2.0
- **Patterns:** 51+ detection patterns
- **Severity Levels:** Critical, High, Medium, Suspicious, Low