> For the complete documentation index, see [llms.txt](https://mango-5m.gitbook.io/mango5m-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mango-5m.gitbook.io/mango5m-docs/resources/mango-admin/features/honeypots.md).

# Honeypots

Decoys a cheat menu will find and a real player never will.

A honeypot is something that exists only to be tripped. Nothing legitimate on your server ever touches one, so anything that does was looking for it.

{% hint style="warning" %}
**These are not commands.** A cheat menu never types anything. It dumps what the client has registered — events, exports — and fires them. So the decoys are the things it dumps.
{% endhint %}

## Where they live

There is **no Honeypots page in the panel**. The decoys are defined in a config file, and every trip is written to the audit log under **Honeypots**.

That is deliberate. A decoy an admin account can switch off is a decoy a *stolen* admin account can switch off, and the account a cheat most wants is the one that can turn the alarms off. Changing a honeypot needs file access and a restart.

{% code title="shared/config/honeypots.lua" %}

```lua
Config.Honeypots = {
    enabled = true,

    -- what a decoy gets when it does not say otherwise
    defaults = {
        severity = 'high',       -- low / medium / high / critical
        alert    = true,         -- notify every staff member online
        evidence = true,         -- screenshot their game before anything else
        kick     = false,
        ban      = false,
        banDays  = 0,            -- 0 = permanent
        cooldown = 30,           -- seconds before the same player can retrip it
    },

    staffExempt = true,          -- staff are never kicked or banned by one. Still logged

    list = {
        -- your decoys go here
    },
}
```

{% endcode %}

## The five kinds

| Kind           | Caught how                                                                               |
| -------------- | ---------------------------------------------------------------------------------------- |
| **Event**      | A net event no legitimate script calls, registered on the server **and** on every client |
| **Export**     | A client export like `exports.mango_admin:GiveMoney()` that nothing calls                |
| **Item**       | An item in your inventory config with no legitimate way to obtain it                     |
| **Permission** | A privileged-looking panel action nobody is granted — reaching it means a forged request |
| **Entity**     | A prop somewhere nobody stands, watched for interaction, deletion or a teleport onto it  |

Each entry in `list` may override any of the defaults, so a low-value trap can log quietly while a serious one empties the room.

{% hint style="info" %}
**A bad entry is named and skipped, never guessed at.** On boot each decoy is checked; anything malformed is printed to the console with its name and left out, rather than silently registering something that will not fire.
{% endhint %}

## What happens when one trips

Always logged. Then, per honeypot: staff alerted, evidence taken, a Discord post, a kick, a ban.

The order matters: **a screenshot is asked for first**, and only once the first frame has arrived — or been given up on — is anybody kicked or banned. A player who is already gone cannot be photographed.

Staff are exempt from the kick and the ban, never from the log. A staff member testing a decoy is not thrown off their own server, and the line is marked as staff so the test can be seen to have worked.

## Evidence

A burst of three frames about seven-tenths of a second apart, so a menu that is only up for a moment is still caught by one of them, at 1600px on the longest side — enough to read a menu's own text.

They are resized in the player's own NUI before anything leaves their machine, then sent up in paced pieces on the same rate limiter as report clips.

{% hint style="info" %}
**A kick or ban waits for the first frame and no longer.** Waiting for all three would leave somebody you are banning on the server for another half a minute. The rest keep arriving while they are still connected, and the log says how many made it.
{% endhint %}

## Reading the trips

**Audit Log → Honeypots.** Who, which decoy, when, where they were standing, their identifiers, and the evidence. Click a name to open their profile — online or not.

## Discord

One message per trip, and when the screenshot lands a few seconds later **the same message is edited** to carry it — so the channel gets one line per incident rather than two. Mention a role for the serious ones with `webhook.mention` and `mentionSeverity`.

{% hint style="info" %}
**A screenshot is the game view, not the desktop.** `screenshot-basic` captures the client's game render target; that is what the plugin does and no resource can reach outside it. A menu drawn by the game is captured. A browser window in front of FiveM is not.
{% endhint %}