See what a VegaSec risk report looks like before sharing a token or repository.
Public, no-login examples for token launches, DeFi repositories, AI backends and thin-evidence projects. These samples sell the artifact: a clear verdict, evidence trail, source confidence and next action your team can forward.
Sample reports pack
Report examples should feel like forwardable cockpit artifacts, not placeholder cards.
Browse by use case
4 surfaces
Inline report preview · fictional fixture
VegaTokenVulnerable.sol · Solidity static scan
Slither + semgrep output enriched with confidence, exploitability and remediation. The full report renders the audit cockpit, every finding, the limitations panel and the scanned source. This preview shows two findings so you can read the artifact shape without leaving the page.
- criticalExploitability: unknown
tx.origin is used for authorization in the vulnerable self-audit fixture.
VegaTokenVulnerable.sol:24 · semgrep:vegasec-tx-origin-auth
tx.origin is used for authorization in the vulnerable self-audit fixture.
RemediationGate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.
- criticalExploitability: unknown
Low-level value transfer to msg.sender occurs before effects are applied.
VegaTokenVulnerable.sol:39 · semgrep:vegasec-low-level-call-untrusted
Low-level value transfer to msg.sender occurs before effects are applied.
RemediationCheck the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.
Featured sample reports
10 public artifacts
Thin Liquidity Token Audit
THIN / SOLANA
An AVOID-style launch review showing fragile pool depth, concentrated control and weak source confidence before a team exposes its community.
Verdict
Block from promotion
Open manual review
- Pool depth is too thin for public promotion
- Owner and holder concentration require manual review
- Official-source confidence is weak
Pre-Launch Token Watchlist
LAUNCH / BASE
A WATCH-style launch report with usable market data, visible liquidity limits and follow-up checks before a token team shares the asset publicly.
Verdict
Monitor before public promotion
Schedule follow-up scan
- Market data is usable but not SAFE-grade
- Liquidity and holder drift need follow-up
- Clear no-advice next action for the launch team
Liquidity Depth Watch
DEPTH / ETHEREUM
A WATCH token report where verified routing is present, but pool depth and holder spread still need monitoring before public distribution.
Verdict
Monitor before public promotion
Schedule follow-up scan
- DEX routing is visible but liquidity depth remains capped
- Holder spread is improving but still concentrated
- Recommended action stays monitoring-first
Missing Source Token Snapshot
MISSING / BNB
An UNKNOWN token report for a target where market context exists but source confidence is too thin for a responsible trust label.
Verdict
Insufficient evidence
Collect more evidence
- Verified source was not available
- Market identity alone is not enough for trust
- Manual source collection is required
Mature Market Token Baseline
MATURE / BASE
A high-confidence token baseline with low public-risk signals, still framed as evidence for review instead of a buy recommendation.
Verdict
Cleared for watchlist
Add to monitored universe
- Source and market evidence are consistent
- Ownership and trading risk indicators are low
- Report remains no-advice and evidence-only
DeFi Repository Risk Review
public-defi-protocol/core-contracts
A Repository Audit example for a public DeFi codebase with visible activity, reviewable controls and security questions a buyer can understand.
Verdict
Monitor before public promotion
Schedule follow-up scan
- Recent maintainer activity is visible
- Documentation and license evidence are present
- Security and CI posture still need operator review
Low Evidence Repository Snapshot
thin-evidence/api-service
An UNKNOWN Repository Audit example for public projects where the available evidence is too thin to support a buyer-facing trust label.
Verdict
Insufficient evidence
Collect more evidence
- Public evidence is too thin
- Documentation and security files are missing
- Manual evidence collection is required
Security Kernel Repository Baseline
audited-protocol/security-kernel
A strong public repository baseline with mature documentation, visible review process and low operational evidence gaps.
Verdict
Cleared for watchlist
Add to monitored universe
- Maintainer cadence and release notes are visible
- Security policy and tests are present
- Operator sign-off can focus on deeper evidence
Stale Repository Watch
stale-protocol/legacy-core
A WATCH repository report where public code exists, but stale maintenance and unresolved evidence gaps block stronger trust language.
Verdict
Block from promotion
Open manual review
- Release cadence looks stale
- Security policy needs verification
- Buyer-facing report recommends operator follow-up
AI Agent Runtime Review
agent-stack/policy-runtime
A WATCH repository report for an AI-agent runtime where permissions, audit logs and policy surfaces need deeper operator review.
Verdict
Monitor before public promotion
Schedule follow-up scan
- Permission boundaries are visible but need review
- Audit-log behavior should be verified
- Runtime policy claims require evidence
VegaSec Solidity self-audit
Same pipeline, vulnerable vs remediated.
We run VegaSec against our own fictional internal Solidity fixtures so a buyer can see what the audit pipeline surfaces on a known-broken contract versus a remediated counterpart. Fictional contracts only: no token launch, no investment, no real asset.
VegaSec NFT audit reference
ERC-721 / ERC-1155 contract and collection metadata risks.
A reference NFT audit on a fictional internal Vega collection. Surfaces contract control, metadata mutability, mint supply, royalties and upgradeability risks. Read-only: no wallet, no signature, no account. Live submissions land in the next slice.