This has been working good for a long time, but we found today that people are able to open peoples boxes, quarries etc, even if they are not friended. It has worked fine for the last year at least until now. Here is my config.

{
  "AdminCanLoot": true,
  "CanLootBackpack": false,
  "CanLootBackpackPlugin": false,
  "CanLootCorpse": false,
  "CanLootEntity": false,
  "CanLootPlayer": false,
  "CanPickup": false,
  "ExcludeEntities": [
    "mailbox.deployed",
    "vendingmachine.deployed",
    "campfire",
    "water_catcher_large",
    "water_catcher_small",
    "researchtable_deployed",
    "recycler_static",
    "pumpjack-static",
    "woodbox_deployed",
    "box.wooden.large",
    "repairbench_deployed",
    "waterbarrel",
    "fridge.deployed",
    "cupboard.tool.deployed",
    "workbench1.deployed",
    "workbench2.deployed",
    "workbench3.deployed"
  ],
  "UseCupboard": false,
  "UseExcludeEntities": true,
  "UseFriendsAPI": true,
  "UseOnlyInCupboardRange": false,
  "UsePermission": false,
  "UseTeams": true,
  "UseZoneManager": true,
  "ZoneID": [
    "13724762",
    "46192562"
  ],
  "ZoneManagerIncludeMode": false
}​

First, check carefully the list of exceptions. There are a lot of unnecessary elements, for example: "box.wooden.large" - this means that the looting of large boxes is not controlled by the plugin.
Secondly, I will check the work of the plugin on the default config, with friends and without.

Merged post

Update: I checked the plugin for you, with the default config, using friends and without: everything works as it should.

Ok thanks for checking it, I see what i did wrong there now. I will get that out of there asap!

Note: you do not need to exclude static entities, like : "recycler_static", "pumpjack-static", because it's not have owner and no need to exlude vending machine, because it handled by plugin and give access only to vending machine front for customers.