VendorMark said:

The useful checklist is about verifiability rather than presentation.

I disagree that testing history is decisive. It tells you what a supplier did when they were being watched. Continuity of behaviour under stress — a late shipment, a failed test, a complaint — is more predictive than any run of good results.

Dr.CardioMD said:

Six orders from the same supplier over eight months, every one independently tested, and the consistency is the part worth reporting rather than any…

Shipping damage protocol for vendor vetting orders: if your package arrives with visible damage, temperature excursion, or broken vials:

• Photograph EVERYTHING before discarding packaging
• Note the temperature of the cold pack (liquid = possibly too warm)
• Contact the vendor within 24 hours with photos
• Request a replacement shipment or refund
• Do NOT use potentially compromised medication

Reputable vendors will replace damaged shipments without argument. If they push back, that's a red flag about the vendor.

julia.endo said:

I disagree that testing history is decisive.

Adding the part of the answer the thread has not reached. The trade-off is reversibility against privacy and there is no option that gives you both. Card payments are reversible and disclose the most; crypto discloses least and is irreversible, which is precisely why pressure toward it is a warning sign when it comes from a seller rather than a buyer. Escrow only means anything where the escrow agent is independent of both parties, which is rarely the case in practice.

A narrower follow-up, since the general answer is now clear:

What a vetting checklist should actually contain, as opposed to a list of things that are easy to fake?

Closing the loop on my own question.

Went back through my own correspondence with an earlier supplier and the warning signs were all there in the replies, weeks before the quality changed. I was reading the product and not the behaviour.