QBCore and ESX power most FiveM roleplay servers, which means their event names are public and heavily targeted. The good news: securing them comes down to a few repeatable habits.
The core frameworks are reasonable. The risk is that everyone knows their default event names, and many community resources built on top of them trust the client or skip server-side checks. Most of the danger lives in the resources you add, not the framework itself.
For every privileged action (admin commands, job actions, garages, money), confirm on the server that the player calling it actually has that permission. A client-side check, or trusting a job the client claims to have, is not protection.
ESX and ox_lib/QBCore callbacks receive arguments from the client. Validate every one: correct type, sane range, and that the player is allowed to ask for it. Never build a query or a payout directly from raw callback input.
Amounts, prices, item names, coordinates, target player IDs: if the client sent it, treat it as hostile. Decide these values from server-side data instead.
Renaming the standard ESX/QBCore trigger names makes them harder to find and target. Treat this as a layer on top of validation, not a replacement for it.
Run current server artifacts, update your framework and resources, and follow the developers for security fixes. A lot of public exploits target outdated versions of popular resources.
DistortionUK audits QBCore and ESX servers, finds the resources that can be exploited, and gives you the fix. The first scoping look is free.