Program risk

The deployed bytes are never matched against any source.

One recorded deployment is not evidence there was only one.

Upgradeable is a capability, not a finding.

A clean mint says nothing about the program behind it

A token's authorities can be revoked and its metadata frozen while the program a holder actually interacts with — a DEX, a launchpad, a staking contract — remains replaceable by a single key. Paste a program id and Evidesa reads what the chain records: which loader owns it, whether its code can still be changed, who holds that power, and when it was last deployed.

Upgradeability is how bugs get fixed, so nothing here is scored and nothing feeds a risk category. What it establishes is narrower and more useful: an upgradeable program's behaviour tomorrow is whatever its authority deploys tomorrow, which is what every decode, audit and review of it today quietly assumes will not happen.

Loadernot read
Mutabilitynot read
Upgrade authoritynot read
Last deploymentnot read

The id of a deployed program — a DEX, a launchpad, a staking contract. Not a token mint and not a wallet: those are accounts programs own, and this bench will say so if you paste one.

What this bench does not establish

Verified buildMatching deployed bytes against a public source build needs a third-party verification registry this build does not query. Absence of the check is not evidence either way.
Program ageFirst deployment time is not stored on the account. The slot shown is the LAST deployment, so a program redeployed yesterday reads as yesterday however old it is.
Upgrade historySignatures touching the program-data account are counted within a bounded page. A full count needs a historical scan this bench does not run, and the result says when the bound was reached.
Who holds a keyThe chain records what OWNS an authority account, not who holds its keys. A multisig authority records that the authority itself requires several signatures — never that several people hold them.