Security & Server Authority

Security & Server Authority

Trust boundaries for inventory, admin, robbery, links and integrations.

Applies to: Nord Inventory v2.0.0

Core rules:

• never trust NUI/client item amounts, metadata or permissions without server validation;
• use ACE/server-only license data for administration;
• keep owner-only restore separate from routine admin permissions;
• validate player distance/session identity for remote inventory access;
• validate vehicle lock/movement/range continuously during trunk sessions;
• validate external recommended-script URLs as http/https on server and NUI sides;
• use provider ownership for runtime registrations;
• do not expose privileged exports through unrestricted net events.