Skip to main content

​
Protect the server license

The HumaLike server license is a secret. Configure it with server-only set:
Never use setr, commit the value, paste it into a client script, include it in a screenshot, or publish it in logs. Rotate it from the dashboard if exposed. HumaLike derives short-lived runtime access from the license. Do not copy, persist, log, or manually configure those runtime values.

​
Trust boundaries

Client events and action parameters are untrusted. Custom providers must enforce permissions and validate player state, distance, item names, quantities, metadata, account amounts, and framework identifiers on the server. Use ReportPlayerEvent from an authoritative server handler. Do not expose a generic client event that lets a player report arbitrary identity, item, badge, or roleplay observations.

​
Separate custom code

Keep custom bridges outside the humalike directory. This prevents accidental credential disclosure, makes ownership clear, and permits complete verified resource updates. Register only the domains the bridge implements. Use specific provider names, minimal exports, and the least ACE permissions necessary.

​
Source-available license

HumaLike for FiveM is released under the PolyForm Shield License 1.0.0. You may use and modify it as part of a monetized FiveM server. You may not use it to provide a product or service that competes with HumaLike’s AI NPC software or services. The repository’s license is authoritative.

​
Vulnerabilities

Do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting and include the affected release, impact, and reproduction steps without real credentials.

​
Next