VegaSec Trust Index
Public-data triage view of recent VegaSec scans. Score reflects automated evidence from public sources; it is not a recommendation to buy, sell, hold, or invest, and it is not a formal audit verdict.
- Score is public-source triage, not a safety or value claim.
- Sample data only. Live ranking thaws after operator capacity and anti-abuse review.
- Private Review is intentionally separate. Paid review does not change a public score.
- Entries are removed, never demoted, when they fall out of eligibility.
Ranking visual
The index reads like a live intelligence board, with public evidence and conservative risk bands.
Coverage mode
Public scans + controlled preview
Live storage is used only when enough eligible reports exist; sample rows stay labeled until then.
Freshness
Recency first, stale states visible
Repository entries surface stale or abandoned status instead of hiding changed code.
Eligibility rule
Removed, not demoted
When an entry falls out of the evidence set, VegaSec removes it rather than implying a new score.
Score bands
0 – 19
AVOID-style triage
Multiple high or critical findings, low source confidence, or unverified context. Public action should pause until a Private Review or a re-scan with better evidence.
20 – 49
High caution
Notable findings or thin evidence. Worth a Private Review before relying on the artifact.
50 – 69
Watch
Mixed signals: some evidence, some gaps. Re-scan after material changes to the target.
70 – 89
Clear surface (automated)
No critical or high findings via static analysis. Not a safety claim — human review still recommended for diligence work.
90 – 100
Strong surface (automated)
No critical or high findings, verified source, and high source confidence. Not a safety claim — human review still recommended for diligence work.
Index entries · sample
8 fictional preview entries
Showing the newest eligible entries first. Switch to Score to rank by automated triage score.
- Entry #01TokenWatch◈PRE-
Pre-launch watchlist sample
Token · base · fictional pair · dexscreener / public pair
Evidence packet
Usable market data, visible liquidity limits, follow-up needed before public promotion.
- Entry #02RepositoryClear surface (automated)⌘PUBL
Public-defi-protocol/core-contracts
Repository · public github fixture · github public
Evidence packet
Recent maintainer activity, documentation present. Security and CI posture need operator review.
- Entry #03RepositoryHigh cautionSTALE⌘THIN
Thin-evidence/api-service
Repository · public github fixture · github public
Evidence packet
Thin maintainer activity, sparse documentation. Evidence insufficient for buyer-facing trust label.
- Entry #04TokenAVOID-style triage◈THIN
Thin-liquidity launch sample
Token · solana · fictional pair · dexscreener / pair
Evidence packet
Pool depth thin, owner and holder concentration high, source confidence weak. Public action should pause.
- Entry #05NFTWatch◆VEGA
Vega Reference Collection
NFT · ERC-721 reference · rpc_state + metadata_uri
Evidence packet
Upgradeable proxy with owner-controlled admin, mutable base URI. Operator follow-up recommended.
- Entry #06SolidityClear surface (automated){}VEGA
VegaCreditsLedger
Solidity · fictional ledger fixture · paste / fixture
Evidence packet
Append-only ledger fixture: no transfer market, non-transferable units. No critical/high findings.
- Entry #07SolidityStrong surface (automated){}VEGA
VegaTokenFixed
Solidity · self-audit reference · paste / fixture
Evidence packet
Remediated counterpart of the vulnerable fixture. No critical or high findings. Verified source.
- Entry #08SolidityHigh caution{}VEGA
VegaTokenVulnerable
Solidity · self-audit reference · paste / fixture
Evidence packet
tx.origin auth, selfdestruct reachable, unchecked low-level call, timestamp-based randomness. AVOID-style triage.
What this index is, and is not
- This is a controlled preview. Live ranking thaws after operator capacity + anti-abuse review.
- Score is automated public-source triage. Not a financial recommendation, not a formal audit verdict, not a future-behavior promise.
- A high band does not protect buyers. A low band is not fraud evidence. Both still need diligence.
- Private Review is paid + confidential. It is intentionally separate from the public score and never raises it.
- Entries falling out of eligibility are removed, not demoted. Eligibility rules are documented in docs/specs/trust-index.md.
- VegaSec does not endorse any entry. The Trust Index is a triage view, not a marketplace or a watchlist signal service.