Start with the exact resource you want to change. Read its fxmanifest.lua, configuration and documented exports before editing. Record the installed QBCore and resource revisions, copy the configuration and database to a private test server, and change one behavior at a time.
Setup and checks
Use the configuration keys that the resource actually reads. The previous Config.Jobs and Config.MLOAccess examples were not universal QBCore interfaces. Door access belongs to the installed door-lock resource; jobs, grades and payment intervals must match your framework and payment implementation. Keep custom changes out of unrelated core files.
Treat client events as requests, not proof of completed work. Calculate rewards and verify job, duty, location, items and completion state on the server. Reject duplicate claims and clear completed work before crediting a reward. Do not expose a payment event that trusts a job or amount supplied by the player.
Before release, test a valid action, the wrong job, an off-duty player, missing items, a repeated request and a reconnect. Check server logs and persistent data as well as the visible UI. Compare server profiler captures for server work; client resmon results alone cannot measure server-side execution.
