VoidHubScripts’ vhs-recycle provides warehouse collection, processing and material sales. The reviewed manifest identifies version 1.2. Its README lists ESX, QBCore and Qbox, but the actual bridge selects esx or qbcore and calls their APIs; Qbox compatibility depends on the corresponding compatibility layer.
Dependencies and configuration
The manifest loads both ox_lib and oxmysql. The client uses ox_target or qb-target. Add the recycle item and configured materials to the chosen inventory. Settings are in configs/config_main.lua; the server-only webhook configuration is configs/sv_webhook.lua. A webhook logs activity to the configured destination and should remain private.
Reward validation must be repaired
In src/server/s_main.lua, the sale callback calculates money from a price supplied by the client instead of looking it up in the server item table. The collection callback grants a recycle item without verifying the work stage or player location there. These are concrete reasons not to deploy the reviewed version unchanged on a live economy.
Test a corrected version
Have a developer derive prices and allowed items on the server, validate positive bounded quantities, enforce location and work progression, and check successful item removal before payment. Then test full inventories, cancellation, repeated requests and mismatched prices in an isolated environment. A configurable UI and Discord log do not establish secure reward handling; this source review is not a complete security audit.