This is the customer-facing Private Review skeleton: executive summary, findings, evidence, attack/failure mode, remediation, limitations, and an operator approval log. It keeps automated scan output, agent drafts, and reviewed claims visibly separate.
Sample report
Evidence authority
E-001 · Deterministic evidence
VegaSec public scan baseline
Automated scan flagged mutable fee controls and low source-confidence context.
E-002 · Agent draft
Audit swarm draft memo
Draft hypothesis: fee owner controls could create a launch-room trust objection if not disclosed.
E-003 · Operator-approved claim
Human operator review
Operator confirmed that the public memo should call for owner-control disclosure and remediation evidence before delivery.
Findings format
Finding 1 · Operator-approved claim
Severity: High · Confidence: Medium
The launch team should explain who controls fee changes and provide remediation or disclosure before sending the artifact to buyers.
Attack / failure mode: If owner-controlled fees change after promotion, buyers may see transfer outcomes that differ from the public launch narrative.
Remediation: Document the owner path, add timelock/multisig evidence where applicable, and re-scan after the control change or disclosure ships.
Finding 2 · Agent draft
Severity: Medium · Confidence: Low
The public data snapshot suggests concentration risk, but the memo should keep this as a review question until stronger evidence is available.
Attack / failure mode: A concentrated liquidity position can make exit depth fragile during launch volatility.
Remediation: Provide lock/vesting context, add public references, and move the claim to operator-approved only after the supporting evidence is reviewed.
Delivery checklist
01 · Basic Review / Priority Review / Deep Review
Intake and scope confirmation
Confirm target, review tier, contact path, public-source boundaries, and any customer-provided links before work starts.
02 · Basic Review / Priority Review / Deep Review
Automated scan baseline
Run the public VegaSec scan first and preserve score, confidence, evidence, limitations, and report URL as the deterministic baseline.
03 · Priority Review / Deep Review
Manual/operator review
Operator reviews evidence, validates severity/confidence, rejects unsupported agent text, and writes buyer-call ready notes.
04 · Basic Review / Priority Review / Deep Review
Limitations and evidence separation
Separate deterministic evidence, agent draft text, and operator-approved claims so the recipient can see what was proven and what was reviewed.
05 · Basic Review / Priority Review / Deep Review
Delivery package
Deliver Markdown plus shareable HTML/report preview with executive summary, findings, evidence, failure modes, remediation, and limitations.
06 · Priority Review / Deep Review
Follow-up monitoring offer
Offer re-scan after remediation and Continuous Watch setup for projects that want recurring stale-change checks.
Markdown preview
# VegaSec Private Review — VSPR-20260602-SAMPLE Tier: Priority Review Target: 0x1234567890abcdef1234567890abcdef12345678 Prepared for: Example Launch Team Prepared at: 2026-06-02 ## Executive summary - This Private Review turns a public scan into an operator-reviewed memo for a launch diligence window. - The sample target shows one high-severity owner-control finding and one medium-confidence liquidity concentration finding that should be resolved or disclosed before a buyer call. ## Scope - Public token/contract evidence and available source references. - Read-only analysis only; no wallet connection, custody, privileged key, or market recommendation. - Operator-approved claims are separated from deterministic evidence and agent draft text. ## Evidence ledger - E-001 · Deterministic evidence · VegaSec public scan baseline: Automated scan flagged mutable fee controls and low source-confidence context. - E-002 · Agent draft · Audit swarm draft memo: Draft hypothesis: fee owner controls could create a launch-room trust objection if not disclosed. - E-003 · Operator-approved claim · Human operator review: Operator confirmed that the public memo should call for owner-control disclosure and remediation evidence before delivery. ## Findings ### Finding 1 — Owner can alter launch fees - Severity: High - Confidence: Medium - Evidence: E-001, E-003 - Authority: Operator-approved claim The launch team should explain who controls fee changes and provide remediation or disclosure before sending the artifact to buyers. **Attack / failure mode:** If owner-controlled fees change after promotion, buyers may see transfer outcomes that differ from the public launch narrative. **Remediation:** Document the owner path, add timelock/multisig evidence where applicable, and re-scan after the control change or disclosure ships. ### Finding 2 — Liquidity concentration needs follow-up - Severity: Medium - Confidence: Low - Evidence: E-001, E-002 - Authority: Agent draft The public data snapshot suggests concentration risk, but the memo should keep this as a review question until stronger evidence is available. **Attack / failure mode:** A concentrated liquidity position can make exit depth fragile during launch volatility. **Remediation:** Provide lock/vesting context, add public references, and move the claim to operator-approved only after the supporting evidence is reviewed. ## Limitations - This is a Private Review memo, not a formal audit attestation or investment recommendation. - No private repositories, seed phrases, wallet credentials, or API keys are required or reviewed in this template. - UNKNOWN or low-confidence areas remain limitations until additional evidence is supplied and reviewed. ## Delivery checklist - [ ] Intake and scope confirmation (Basic Review / Priority Review / Deep Review) — Confirm target, review tier, contact path, public-source boundaries, and any customer-provided links before work starts. - [ ] Automated scan baseline (Basic Review / Priority Review / Deep Review) — Run the public VegaSec scan first and preserve score, confidence, evidence, limitations, and report URL as the deterministic baseline. - [ ] Manual/operator review (Priority Review / Deep Review) — Operator reviews evidence, validates severity/confidence, rejects unsupported agent text, and writes buyer-call ready notes. - [ ] Limitations and evidence separation (Basic Review / Priority Review / Deep Review) — Separate deterministic evidence, agent draft text, and operator-approved claims so the recipient can see what was proven and what was reviewed. - [ ] Delivery package (Basic Review / Priority Review / Deep Review) — Deliver Markdown plus shareable HTML/report preview with executive summary, findings, evidence, failure modes, remediation, and limitations. - [ ] Follow-up monitoring offer (Priority Review / Deep Review) — Offer re-scan after remediation and Continuous Watch setup for projects that want recurring stale-change checks. ## Operator approval - Reviewer: VegaSec operator - State: Operator-approved claim - Note: Customer-facing claims must be reviewed before delivery; agent draft text is never published as final authority by itself.