Paste an address or URL. Get the report.

One public path for tokens, repositories, Solidity source, and NFT contracts: paste the target, let VegaSec auto-detect the route, run a read-only scan, then review and share the report. No wallet, no login, never financial advice.

Secondary pathsSee sample reports Request a Private Review

Paste → Scan → Review

Paste address or URL

Default path. Paste a token address, explorer URL, or DexScreener URL. VegaSec chooses the route, reads public sources only, and returns score, verdict, confidence, evidence, and a shareable report.

Paste address or URL

Paste any supported token address, explorer URL, or DexScreener pair URL. Auto chain detection is on by default.

Limit: 2,048 characters for explorer or DexScreener URLs; raw addresses stay much shorter.

Default public scans create a shareable report when the target is supported. Private Review opens a confidential intake with only safe scan metadata in the URL; paste the private target/source inside the form.

Paste
Scan
Review
Share

Optional settings

Default is public token scan with automatic chain detection. Open this only when you need a private intake or a specific chain hint.

3 — Choose visibility

Optional chain hint

Selected: Auto

Leave on Auto unless the address is ambiguous across chains.

Sample targets

Click to fill

These are pre-validated token inputs. Selecting one only fills the field — it does not run the scan until you press the audit button.

What you get

· Score — 0–100 derived from severity counts. Lower means more risk.
· Verdict — operator-facing English (e.g. AVOID, WATCH, CLEAR-style triage).
· Confidence — separate axis. Pushes verdict toward UNKNOWN when low.
· Evidence — public signals, findings with class + severity, source provenance.
· Share / export — public report URL + Markdown export with disclaimers baked in.
· Escalation path — direct CTA to a Private Review when triage is not enough.

Need a Private Review? →

Trust posture

· No wallet, no signature, no account required.
· Public sources only. Missing or malformed context fails closed to UNKNOWN — never demo data.
· Solidity source pasted into this page is sent to a VegaSec-controlled worker for analyzers and persisted with the report id so the shareable link works. It is not sold or forwarded to third parties. Verified explorer URLs hit the explorer API server-side.
· Output is static + read-only triage, not a formal audit verdict or financial advice.

UNKNOWN: Returned when the input is malformed or required public context is missing. We never substitute demo values to make a report load.
Static analysis: Tools like slither and semgrep read the source without executing it. They surface known patterns; they do not prove or disprove an exploit.
Source confidence: A 0–100 measure of how much we trust the input data. The verdict is downgraded toward UNKNOWN as confidence drops.