How to Review AI-Generated FiveM Code

Use AI to explain a small piece of FiveM code or propose a narrow change, then verify the result against your exact framework source. Generated code is a draft: it can invent exports, miss dependencies and trust values that should be checked on the server.

Provide a bounded task

Supply the relevant file, manifest, framework version and exact error or expected behavior. Remove license keys, database credentials, webhook URLs and player information. Share third-party code only when you are allowed to.

Ask for one change at a time: explain a callback, repair a demonstrated error, or add one validated interaction. A request for an entire economy or job system hides too many design decisions.

Review the proposal before running it

1. Check every native, event and export against the installed resource or official documentation. Confirm whether it runs on the client or server.
2. Compare the proposed dependency list and start order with the actual manifest. Reject guessed SQL tables and undocumented framework internals.
3. For any reward or privileged action, verify identity, permission, ownership, position and current state on the server. Do not accept a client-supplied price or reward as authority.
4. Look for repeated events, duplicate payments, uncapped loops and callbacks that never return. Ask for an explanation of the failure paths.
5. Apply the smallest reviewed diff on staging and keep the previous version for rollback.

Test the behavior you will deploy

Run the normal interaction, invalid input, repeated requests, an unauthorized player, reconnect and restart. Compare persistent state before and after so a visually working menu does not conceal duplicate writes.

If the change claims to improve performance, measure the same action before and after. An AI explanation is not a benchmark or a test result. Follow the Cfx.re event-security guide for the trust boundary.

Reference documentation

Cfx.re — resource manifest