Release notesRelease notes

Detection audit release. We read every check against what the game actually sends. Checks that could never fire now work, the ones that could not be fixed are retired, and every new kick or ban ships on probation until you have watched it on your own server. The dashboard gains live monitoring, invited admins, game-event rules and a searchable case gallery.

• BreakingProbation: some checks in this release can kick or ban for the first time, and none of them has been seen on a live server yet. So they ship on probation. They detect and report exactly as normal, but they only warn, and each event tells you what they would have done (`[probation: would KICK …]`). That covers heartbeat, projectile abuse, vehicle flooding, godmode, the revived weapon checks, weapon giving and stripping, the VPN check, and the new arms of speed, damage, injector and honeypot checks. Watch them for a week. When every hit is a cheater, release that check with `Config.Probation.<name> = false` in config.lua, or all of them with `Config.ProbationEnabled = false`. The dashboard can't release them, and marks them Probation. See Configuration → Probation in the docs.
• FixedSwitching a detection off on the dashboard now switches it off on your server. Before, an off switch could be ignored and the check kept its own default.
• FixedWeapon checks skipped about half of all weapons, including most rifles, the carbines, the marksman rifles and fists. Rapid fire, magic bullet, fast shoot, the weapon denylist and the one-punch check now see them.
• FixedAir brake, water walk and vehicle gravity asked the server for data only the game client has, so they never fired. They now run on the client and report to staff as warnings.
• FixedPolice cuff and rob scripts no longer get officers punished. Weapon stripping and weapon giving now need the same player to hit three or more different players within ten seconds, and stripping kicks instead of banning.
• FixedGodmode reads the invincibility flag the server can actually see. It stands down on character select, the creator and while a player is downed, warns on each confirmed episode and, once released from probation, kicks on the third.
• FixedBreaking a fence or other map prop no longer kicks the player. Invisibility only flags a hidden player who is moving, and player launching never flags the player who was launched.
• FixedMoney injection now reads the framework's own money events (ESX, QBCore, Qbox), so it sees real credits, and it ships at warn. Raise it once your ceilings in config.lua sit above your largest legitimate payout.
• FixedA staff member who loses their bypass is checked again on their next detection instead of staying exempt until restart. Players relink within seconds after `restart sculkanticheat`, and ESX servers now receive the player-loaded signal.
• AddedVehicle health cap: a driven vehicle with body or engine health above the game's 1,000 maximum. Ships at warn.
• Added`sculk_observe_until "7d"` ends observation mode on its own after a set time, and `sculk selftest <playerId>` shows exactly which gate would stop a detection from acting, without punishing anyone.
• AddedEntity firewall recording: `sculkfwrecord 30` watches what your server legitimately spawns and writes a suggested rule set you can review before applying.
• ImprovedThe VPN check uses proxycheck.io over HTTPS by default, and the free tier works. The country filter shares the same lookup, so a join costs one request. At warn, both log the player and let them in. On probation the VPN check also lets VPN users in and logs who it would have refused. Its refusal now respects observation mode, staff exemptions and excuses like every other action.
• Breaking21 detections are retired and no longer run: spoofed bullet, client replays, infinite stamina, voice spoof, outfit change, task clearing, networked tasks, the six vehicle colour, livery, engine, armour, window and dirt checks, proxy detect, connection flood, ESP residue, menu brand strings, hooked natives, tampered environment, night vision and thermal vision. Each one either could never fire, duplicated another check, or read something that is not a cheat. Their keys stay, so your saved settings are kept, and the dashboard and the detections page say why each was retired.
• BreakingThe old heartbeat and challenge protocols are gone; they sent their secrets in the clear. Liveness now rides the existing link: a client that linked, then went silent on Sculk's channel while its game traffic kept arriving, or whose reporting functions were replaced, is kicked by antiHeartbeat once you release it from probation. A hung, paused or crashing game is never judged, and it can never ban.
• BreakingNew defaults: vehicle flooding and projectile abuse now kick (on probation, so they warn until you release them). Invisibility, player launching, collision disabled, handling modifier and vehicle gravity now warn. Soft aim, aim assist and waypoint teleport ship switched off until they are validated in game. Anything you set on the dashboard still wins.
• AddedLive monitoring: watch up to 36 players' game screens at once on the Monitoring page, refreshed every few seconds. It runs only while a staff member has the page open, frames are kept in memory and never stored, and every watch session is written to the logbook. Needs screenshot-basic (or another capture provider) on your server.
• AddedWarns, kicks and bans now show as cards with a short case ID you can search, and a screenshot when one exists. Taking a screenshot automatically on a warn, kick or ban is a setting you choose per action, off by default.
• AddedAdmins: invite staff by email and choose what each one can see and do (players, monitoring, warns, kicks, bans, rules, settings and more). Nobody can grant more than they hold, invite links work once and expire after seven days, and every dashboard action is kept in an append-only logbook.
• AddedRules can now match game events: entity spawns, explosions, weapon damage, particle effects and projectiles. Build conditions with And / Or, read them back as a sentence, and choose block, log, warn, kick or ban. Kicks and bans from rules ship on probation like every new action.
• AddedAnalytics: a globe of where your players connect from, top countries, online-player history over 24 hours to 30 days, and warn, kick and ban totals. Countries come only from lookups the VPN or country check already made; Sculk never sends player IPs to the dashboard.
• AddedA real "exempt txAdmin admins" setting on the dashboard, and a command palette (Ctrl or Cmd + K) to jump to any page, switch server or find a player.
• BreakingAutomatic screenshots on detection were on by default and are now off; turn on capture-on-action per warn, kick or ban if you want them. Dashboard commands now go only to the server picked in the switcher, not to every server on your account. The advanced bans switch is hidden because nothing used it, and replay is labelled for what it records: movement traces, not video.
• ImprovedHonest limits: every fix is covered by tests that failed before it, but some behaviour depends on game data that can only be confirmed on a live server. That is what probation is for: watch a week of your own traffic before you release anything or raise a default. No FiveM resource can see external overlays, DMA hardware or ESP drawn outside the game, and the checks that implied otherwise are among those retired.

Licensing release. Protection runs on a signed licence lease that survives our outages, and your key never crosses the network.

• AddedLicence leases: activation hands your server a signed lease, cached on disk and renewed every heartbeat. If the Sculk website is unreachable your server keeps enforcing from it for up to 72 hours, restarts included.
• ImprovedYour licence key is no longer sent to Sculk. Activation answers a one-time challenge instead, so the key cannot be read off the network.
• ImprovedThe sculk console command now says whether protection is enforcing, and why not when it is not.
• BreakingWithout an active licence (no key, a wrong or revoked key, a lapsed subscription, or a licence bound to another server) detections still run and log, but nothing kicks, bans, blocks or refuses a connection. Keep the resource folder writable so the lease can be cached.

False-positive release for FiveM roleplay servers. Fewer honest players kicked, and client-side detections now actually report.

• FixedClient-side detections stopped reporting about a minute after a player joined. Reports now reach the server for the whole session.
• FixedA client-side report can no longer kick or ban on its own, including on checks with both a client and a server half. It is reported to staff as a warning; server-observed evidence still acts.
• FixedExploit traps and sound-abuse checks no longer kick players when a police, EMS or sound resource starts after Sculk.
• FixedTargeted sounds (PlayOnOne) are no longer read as server-wide broadcasts, and an ordinary 5 m alarm is no longer treated as a mod-menu payload.
• FixedHousing furniture and the mechanic creeper are no longer treated as player cages.
• ImprovedTeleport and speed floors restored to the calibrated 200 m and 12 m/s, so elevators, housing shells and sprint consumables stop flagging.
• Breaking23 checks that misfire on normal roleplay (teleport, super jump, NPC, attachments, cages, vehicle plate/colour/livery/boost/flip, scripted explosions, freecam and others) now warn staff by default instead of kicking. Your dashboard overrides still apply; raise any check once it has run clean.
• BreakingantiCrasher, antiSpoofer and antiGlitchPlayer kick instead of ban. The Discord-required and strict-name policies are now opt-in.

Stability and false-positive pass following the 1.0 launch.

• FixedReduced movement false flags for players on high-latency connections during setback recovery.
• ImprovedFaster staff alert delivery to Discord webhooks under bursty violation loads.
• ImprovedClearer evidence summaries on combat checks in the in-game alert view.

General availability. The full Sculk AntiCheat plugin, licensing, and dashboard.

• AddedFull packet-level check suite across combat, movement, world, player, and protocol behaviour.
• AddedStaged punishments — flag, log, setback, and ban-wave tooling with staff review before action.
• AddedIn-game alerts, Discord webhook alerts, and per-check configuration with verbose mode.
• AddedLicence system with instant key delivery, server binding, and account management.