Accepted answer
Concretely, evaluate a supplier on the documentation they cannot fabricate cheaply, which in practice means lot-specific certificates from a laboratory that hosts its own reports and a testing history that spans more than one lot.
The diagnostic red flags, in rough order of how much they tell you: a certificate whose lot number does not match the vial; a certificate with no method section; a purity figure quoted to two decimal places with no chromatogram; a testing date that precedes the stated manufacturing date; identical certificates across nominally different lots; and "sterile filtered" offered in place of a sterility test. Each of those is a specific inference, not a vibe.
What a verification listing at VendorInvestigate or a rating at PeptideMeter actually evidences is that some process was applied — which is more than nothing and considerably less than an audit. The useful question is what the process consists of and whether its inputs are independently obtained samples or vendor-supplied ones.
The published aggregate datasets from Janoshik, Medutest and PeptideMeter are the closest thing to a systematic evidence base in this space, and the striking pattern across all three is that identity is almost always confirmed, purity is usually acceptable, and content is where the variance lives.
The limitation of the red-flag approach is that it is asymmetric: it identifies bad documentation reliably and good material only weakly.
Test the first lot from any new supplier, set your accept threshold before the result arrives, and keep the certificate with the lot number and the date in one place.