> ## Documentation Index
> Fetch the complete documentation index at: https://docs.humalike.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and license

> Protect server credentials and extend the resource safely.

## Protect the server license

The HumaLike server license is a secret. Configure it with server-only `set`:

```cfg theme={null}
set humalike_license_key "ak_secret_replace_me"
```

Never use `setr`, commit the value, paste it into a client script, include it in
a screenshot, or publish it in logs. Rotate it from the dashboard if exposed.

HumaLike derives short-lived runtime access from the license. Do not copy,
persist, log, or manually configure those runtime values.

## Trust boundaries

Client events and action parameters are untrusted. Custom providers must enforce
permissions and validate player state, distance, item names, quantities,
metadata, account amounts, and framework identifiers on the server.

Use `ReportPlayerEvent` from an authoritative server handler. Do not expose a
generic client event that lets a player report arbitrary identity, item, badge,
or roleplay observations.

## Separate custom code

Keep custom bridges outside the `humalike` directory. This prevents accidental
credential disclosure, makes ownership clear, and permits complete verified
resource updates.

Register only the domains the bridge implements. Use specific provider names,
minimal exports, and the least ACE permissions necessary.

## Source-available license

HumaLike for FiveM is released under the PolyForm Shield License 1.0.0. You may
use and modify it as part of a monetized FiveM server. You may not use it to
provide a product or service that competes with HumaLike's AI NPC software or
services.

The repository's [license](https://github.com/Humalike/humalike-fivem-npc/blob/main/LICENSE.md)
is authoritative.

## Vulnerabilities

Do not open a public issue for a suspected vulnerability. Use
[GitHub private vulnerability reporting](https://github.com/Humalike/humalike-fivem-npc/security/advisories/new)
and include the affected release, impact, and reproduction steps without real
credentials.

## Next

* [Install a verified release](/ai-npc/installation).
* [Apply server-side validation in a bridge](/ai-npc/integrations/provider-api#action-descriptor).
* [Review the public interface index](/ai-npc/reference).