Every token is a program. Serious projects publish the human-readable source so anyone can confirm the program does what it claims. When the source is not verified, all anyone can see is machine code. The checks that look for honeypots, taxes and owner powers can't read it either.
Why it's a red flag for tokens
Verifying source takes a few minutes and costs nothing. A token creator who skips it is either careless or hiding something. For a meme token launched this week, assume the second.
When it's not a red flag
Smart-contract wallets and delegated accounts often show as unverified code. They aren't tokens, and the pattern is normal. Our wallet checker treats these as a low note, not a danger.
"Limited checks" on a result
If a result says limited checks, our main security source was unavailable and we graded from a backup. The honeypot and tax checks still ran, but owner-permission checks did not. Treat the grade as a floor, not a full report.