Troubleshooting

Players get TP_DIST after a teleport from another script

The server can't tell a script teleport from a cheat. Open a grace window right before the teleport with exports['saf-anticheat']:AllowTeleport(src, 10) or TriggerEvent('saf-anticheat:grace', src, 'teleport', 10). See Exports & events. Teleports that only happen on the client (vMenu teleport to waypoint, noclip) can't be seen by the server; add an exemption for the ACE that gives them.

Players in housing shells get TP_OOB

Shells and some MLOs sit well under the map. Lower Config.Movement.MinZ below your deepest shell, and open a grace window in the housing script's enter event.

Cuff scripts raise WEAP_REMOVE_OTHER or PLY_TASKS

Some cuff scripts strip weapons from the suspect or clear their tasks from the officer's side. That is why WEAP_REMOVE_OTHER is not blocked by default, and why a task clear from within Config.Players.TasksNear (5 m) only counts at a low severity and is never certain. If one of your scripts does it from further away, lower the severity or exempt that code.

Carry and escort scripts raise PLY_ATTACH

Fire TriggerEvent('saf-anticheat:grace', src, 'attach') when the carry starts. It covers PLY_ATTACH for 30 s.

One event flags lots of players for EVT_RATE

That event is the resource's own doing. When several players go over the limit within NoisyWindow, the firewall stops checking it until restart and says so in the console. Give it its own limit in Config.Firewall.Limits, or false to skip it.

An event from a resource isn't watched

Auto discovery reads the files each fxmanifest names directly. Files loaded with a glob, like server/*.lua, aren't read. List the events you care about in Config.Firewall.Watch.

A honeypot flags a real resource

Honeypots skip any name a running resource owns. If a resource uses one of those names but wasn't found, remove the name from Config.Firewall.Honeypots.

No screenshots

Screenshots need screenshot-basic started before SAF Anticheat, and Config.Screenshots.Webhook set. They are also limited to one per player per Config.Screenshots.Cooldown seconds. Discord attachment links expire after a while, but the message in the channel stays.

A staff member was kicked

Staff are checked like everyone else. Config.StaffMaxAction caps what happens to them automatically at 'screenshot'. If it is set to nil, staff are treated exactly like players. Check also that the player really counts as staff: Bridge.IsStaff uses the same ACEs and groups as the panel.

Players with addon weapons get DMG_AMOUNT or DMG_RANGE

The damage checks only know the weapons in Config.Combat.Weapons. Add your addon weapons with their damage and range.

The console says OneSync is missing

The server-side checks use events that only exist with OneSync. Turn it on in txAdmin or with set onesync on in server.cfg.

Players get HB_MISS and are kicked

The client side stopped answering 3 times in a row. That usually means the resource was stopped on the client. If it happens to many players at once, check the client console for an error from saf-anticheat and that nothing else stops resources on join.

I want to see what would have happened before going live

Run shadow mode. See Rollout.