Copy the pattern.
Make it yours.

fx_version 'cerulean'
game 'gta5'

lua54 'yes'

author 'Your Name'
description 'A focused FiveM resource'
version '1.0.0'

client_scripts { 'client/*.lua' }
server_scripts { 'server/*.lua' }
shared_scripts { 'shared/*.lua' }

Keep the manifest explicit. Add only files and dependencies the resource actually needs.

RegisterCommand('status', function(source)
    local player = source == 0 and 'console' or GetPlayerName(source)
    print(('[gankbyte] status requested by %s'):format(player or 'unknown'))
end, false)

Start with a harmless command, then add permission checks before exposing server actions.

RegisterNUICallback('close', function(data, cb)
    SetNuiFocus(false, false)
    cb({ ok = true })
end)

Always call the callback, validate incoming data, and keep browser actions separate from privileged server work.

public final class GankBytePlugin extends JavaPlugin {
    @Override
    public void onEnable() {
        getLogger().info("GankByte plugin enabled");
    }

    @Override
    public void onDisable() {
        getLogger().info("GankByte plugin disabled");
    }
}

Keep startup predictable and declare the matching API version in plugin.yml.

@PluginDescriptor(name = "GankByte Helper")
public final class GankByteHelperPlugin extends Plugin {
    @Override
    protected void startUp() {
        log.info("GankByte Helper started");
    }

    @Override
    protected void shutDown() {
        log.info("GankByte Helper stopped");
    }
}

Use RuneLite’s APIs and conventions; do not automate gameplay or bypass the client’s rules.

async function loadJson(url) {
    const response = await fetch(url);
    if (!response.ok) {
        throw new Error(`Request failed: ${response.status}`);
    }
    return response.json();
}

Handle non-2xx responses explicitly and explain CORS when a browser calls another origin.

import argparse


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument('name')
    args = parser.parse_args()
    print(f'Hello, {args.name}')


if __name__ == '__main__':
    main()

Keep command-line input explicit and make the module runnable without hidden global state.

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://example.com/api/status"))
    .timeout(Duration.ofSeconds(10))
    .GET()
    .build();
HttpResponse<String> response = client.send(
    request, HttpResponse.BodyHandlers.ofString());

Use a timeout, inspect the status code, and never hard-code private credentials into a client.

alter table public.items enable row level security;

create policy "Users can read their items"
on public.items for select
to authenticated
using (auth.uid() = user_id);

Enable RLS before exposing a user-owned table and test both allowed and denied reads.