State bag strict mode is disabled, so clients can rewrite entity state

What the console says

sv_stateBagStrictMode is currently DISABLED
When strict mode is OFF, clients are able to freely modify state bag values
ignoreSecurityAdvisory … stateBagStrictMode

What it means

sv_stateBagStrictMode is off. State bags replicate entity and player data, and with strict mode off a client can freely write to them — which means a cheater can change state your scripts trust.

File

server.cfg

Must hold

setr sv_stateBagStrictMode true

How to fix it

1. Add setr sv_stateBagStrictMode true to server.cfg and restart.
2. Expect breakage: any script that writes a state bag from the client without permission stops syncing. That breakage is the point — it is showing you which scripts trust the client.
3. Turn it on, restart, and read the console. Fix the scripts it names rather than turning it back off.
4. If a script cannot be fixed and must keep writing client-side state, that script is the security hole. Weigh it deliberately rather than leaving the whole server permissive for one resource.

When it is not this

This is a POSTURE finding, not an incident. Nothing has been exploited — it reports that the door is unlocked, not that someone came through it. Many established servers run with it off ON PURPOSE because ox_inventory and other widely-used scripts break under strict mode; ox_lib itself warns that enabling it may break things. An owner who has already weighed that has made a legitimate call and must be acknowledged rather than nagged every restart.