What it looks for
The scanner reads each file the way an attacker does: it finds every handler a client can reach — net events, callbacks, commands, NUI callbacks — and follows what the client's arguments touch. Money, items, weapons, admin actions, SQL, code execution and entity control reached by a value the client chose are the findings. Code that merely mentions money is not.
| Finding | Severity | What it means |
|---|---|---|
rce_from_event | critical | Client input reaches load() or loadstring(). Anyone can run code on your server. |
money_from_client | critical | An amount the client sent is added to a player. The classic bank exploit. |
item_from_client | critical | An item name or count the client sent is granted. |
weapon_from_client | critical | A weapon the client named is given. |
sql_concat | critical | A client value is concatenated into a query instead of parameterised. |
admin_no_permission | critical | A kick, ban or similar action with no permission check at all. |
shell_exec | critical | os.execute or io.popen anywhere in the file. |
admin_target_from_client | high | The permission is checked, but the client still chooses who the action lands on. |
entity_from_client | high | An entity chosen by the client is deleted, moved or modified. |
outbound_http | high | The script talks to a third-party URL. Backdoors phone home; so do some licence checks. |
obfuscated_string / encoded_blob / char_assembly | high | Payloads hidden in escaped decimals, base64 blobs or string.char() — how backdoors hide from a grep. |
hardcoded_secret | medium | A token, key or password in the source. |
broadcast_sensitive | medium | Sensitive data sent to every client with -1. |
no_validation | medium | A handler that uses its arguments without checking their type. |
nui_passthrough | low | A NUI callback forwards its payload to the server unchecked. Only matters if the server trusts it. |
Reading the score
The score starts at 100 and each finding takes points by severity, but it is also capped by the worst thing found: a single remote-code-execution finding cannot score above 20 whatever else is clean, because one of those is enough. The verdict bands run from clean through review-worthy to dangerous.
Using it
Open Scanner in the panel, drop the resource's .lua files in — up to 60 files, 512 KB each, 3 MB in total — and read the report. Each finding names the file, the line, the handler it lives in and the argument the attacker controls:
server/main.lua:14 money_from_client critical
event "bank:deposit" — amount reaches Player.Functions.AddMoney uncheckedThe fix is nearly always the same: decide the value on the server. A payout the server computes cannot be chosen by the client, whatever the menu sends.
Argus dogfoods this on its own resource on every release; the anti-cheat scores 100 with zero findings across its own handlers.