See what a VegaSec risk report looks like before sharing a token or repository.
Public, no-login examples for token launches, DeFi repositories, AI backends and thin-evidence projects. These samples sell the artifact: a clear verdict, evidence trail, source confidence and next action your team can forward.
Sample reports pack
Report examples should feel like forwardable cockpit artifacts, not placeholder cards.
What buyers get
A Private Review is confidential and human-reviewed. It does not change the public score on any report.
Browse by use case
4 surfaces
Surface
Token launches
Pre-launch and post-launch market triage.
Surface
Smart contracts
Solidity static analysis with slither + semgrep.
Surface
Public repositories
Maintainer, license, dependency and security signal.
Surface
NFT collections
ERC-721 / ERC-1155 contract + metadata risk (beta).
Inline report preview · fictional fixture
VegaTokenVulnerable.sol · Solidity static scan
Slither + semgrep output enriched with confidence, exploitability and remediation. The full report renders the audit cockpit, every finding, the limitations panel and the scanned source. This preview shows two findings so you can read the artifact shape without leaving the page.
- criticalaccess-controlExploitability: unknown
tx.origin is used for authorization in the vulnerable self-audit fixture.
VegaTokenVulnerable.sol:24 · semgrep:vegasec-tx-origin-auth
tx.origin is used for authorization in the vulnerable self-audit fixture.
RemediationGate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.
- criticalunchecked-callExploitability: unknown
Low-level value transfer to msg.sender occurs before effects are applied.
VegaTokenVulnerable.sol:39 · semgrep:vegasec-low-level-call-untrusted
Low-level value transfer to msg.sender occurs before effects are applied.
RemediationCheck the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.
Featured sample reports
10 public artifacts
Thin Liquidity Token Audit
THIN / SOLANA
An AVOID-style launch review showing fragile pool depth, concentrated control and weak source confidence before a team exposes its community.
Verdict
Block from promotion
Open manual review
Signal
Liquidity
94/100
Signal
Owner control
92/100
Signal
Holder concentration
88/100
- Pool depth is too thin for public promotion
- Owner and holder concentration require manual review
- Official-source confidence is weak
Pre-Launch Token Watchlist
LAUNCH / BASE
A WATCH-style launch report with usable market data, visible liquidity limits and follow-up checks before a token team shares the asset publicly.
Verdict
Monitor before public promotion
Schedule follow-up scan
Signal
Liquidity
48/100
Signal
Social proof
44/100
Signal
Holder concentration
41/100
- Market data is usable but not SAFE-grade
- Liquidity and holder drift need follow-up
- Clear no-advice next action for the launch team
Liquidity Depth Watch
DEPTH / ETHEREUM
A WATCH token report where verified routing is present, but pool depth and holder spread still need monitoring before public distribution.
Verdict
Monitor before public promotion
Schedule follow-up scan
Signal
Liquidity
62/100
Signal
Holder concentration
54/100
Signal
Trading behavior
45/100
- DEX routing is visible but liquidity depth remains capped
- Holder spread is improving but still concentrated
- Recommended action stays monitoring-first
Missing Source Token Snapshot
MISSING / BNB
An UNKNOWN token report for a target where market context exists but source confidence is too thin for a responsible trust label.
Verdict
Insufficient evidence
Collect more evidence
- Verified source was not available
- Market identity alone is not enough for trust
- Manual source collection is required
Mature Market Token Baseline
MATURE / BASE
A high-confidence token baseline with low public-risk signals, still framed as evidence for review instead of a buy recommendation.
Verdict
Cleared for watchlist
Add to monitored universe
Signal
Liquidity
18/100
Signal
Social proof
16/100
Signal
Holder concentration
14/100
- Source and market evidence are consistent
- Ownership and trading risk indicators are low
- Report remains no-advice and evidence-only
DeFi Repository Risk Review
public-defi-protocol/core-contracts
A Repository Audit example for a public DeFi codebase with visible activity, reviewable controls and security questions a buyer can understand.
Verdict
Monitor before public promotion
Schedule follow-up scan
Signal
Evidence depth
48/100
Signal
Activity cadence
45/100
Signal
Issue and PR flow
44/100
- Recent maintainer activity is visible
- Documentation and license evidence are present
- Security and CI posture still need operator review
Low Evidence Repository Snapshot
thin-evidence/api-service
An UNKNOWN Repository Audit example for public projects where the available evidence is too thin to support a buyer-facing trust label.
Verdict
Insufficient evidence
Collect more evidence
- Public evidence is too thin
- Documentation and security files are missing
- Manual evidence collection is required
Security Kernel Repository Baseline
audited-protocol/security-kernel
A strong public repository baseline with mature documentation, visible review process and low operational evidence gaps.
Verdict
Cleared for watchlist
Add to monitored universe
Signal
Issue and PR flow
20/100
Signal
Evidence depth
18/100
Signal
Docs and security signal
18/100
- Maintainer cadence and release notes are visible
- Security policy and tests are present
- Operator sign-off can focus on deeper evidence
Stale Repository Watch
stale-protocol/legacy-core
A WATCH repository report where public code exists, but stale maintenance and unresolved evidence gaps block stronger trust language.
Verdict
Block from promotion
Open manual review
Signal
Issue and PR flow
70/100
Signal
Evidence depth
66/100
Signal
Docs and security signal
64/100
- Release cadence looks stale
- Security policy needs verification
- Buyer-facing report recommends operator follow-up
AI Agent Runtime Review
agent-stack/policy-runtime
A WATCH repository report for an AI-agent runtime where permissions, audit logs and policy surfaces need deeper operator review.
Verdict
Monitor before public promotion
Schedule follow-up scan
Signal
Engineering controls
56/100
Signal
Evidence depth
52/100
Signal
Issue and PR flow
48/100
- Permission boundaries are visible but need review
- Audit-log behavior should be verified
- Runtime policy claims require evidence
VegaSec Solidity self-audit
Same pipeline, vulnerable vs remediated.
We run VegaSec against our own fictional internal Solidity fixtures so a buyer can see what the audit pipeline surfaces on a known-broken contract versus a remediated counterpart. Fictional contracts only — no token launch, no investment, no real asset.
VegaSec NFT audit reference
ERC-721 / ERC-1155 contract and collection metadata risks.
A reference NFT audit on a fictional internal Vega collection. Surfaces contract control, metadata mutability, mint supply, royalties and upgradeability risks. Read-only — no wallet, no signature, no account. Live submissions land in the next slice.
Public-data disclaimer
Example reports are product samples, not live provider output. Live Token Audit and Repository Audit routes require submitted context and fail closed to UNKNOWN when evidence is missing, private, malformed or unavailable.