Hashly has not read WHBAR's issuer permissions yet. This is not a clean result, it is a missing one.

Read from the Hedera mirror node, where a token declares its keys as properties rather than hiding them in contract code. These are the powers the issuer holds, not a judgement about the token: plenty of legitimate projects keep a supply key, and a stablecoin needs a freeze key to comply with the law. What matters is knowing which ones exist before you buy.