Contract checks

First-class signals from the bytecode and its verification:

• Verified source — is the contract's source published on the explorer? An unverified contract can't be audited, and is a penalty, not a neutral.
• Proxy — can the implementation be swapped out from under holders?
• Mint — can the owner mint more supply?
• Owner privileges — can ownership be reclaimed, is there a hidden owner, can transfers be paused, is there a blacklist?

Each is measured (via GoPlus and the explorer) and shown as good / bad / unknown. A token whose bytecode can't be analysed scores as unknown-risk, never as safe.