Security Config
Security Config
Server-level security, permissions, logging and the safe keypad are configured
in shared/security.lua and the server-only shared/security_server.lua.
Admin & state permissions (aces)
Config.AdminAce = 'kartikproperties.admin' -- full admin
Config.StateAce = 'kartikproperties.state' -- state/government authorityGrant them via your server's ace system, e.g.:
add_ace group.admin kartikproperties.admin allow
add_ace group.admin kartikproperties.state allowAnti-abuse & rate limiting
Config.RateLimit = 8 -- max NUI/network events per player per 10s
Config.CreatorSnapSteps = { 0.25, 0.5, 1.0, 5.0 } -- snap increments in the map editor
Config.Debug = false -- set true only for developmentDiscord webhook logging
Config.Webhook = '' -- Discord webhook URL (empty = logging off)
Config.WebhookMinInterval = 2 -- minimum seconds between postsSafe keypad
Shared tunables for safe PIN access:
Config.Safe = {
PinLength = 4, -- digits required
MaxAttempts = 5, -- failed attempts before lockout
LockoutSeconds = 300, -- keypad lockout duration
}Server-only secret (shared/security_server.lua)
Safe PINs are stored hashed (SHA-256) with a server-only pepper. This file never reaches clients.
Config.Safe.Pepper = 'change-me-to-a-long-random-string'Change the pepper to a long random value before going live, and keep it secret. It's mixed into every safe-PIN hash; changing it later invalidates all existing safe PINs.