Banana Peppers

Fetched today, 2026-09-07. The certificate panel on two product pages now carries a second control that opens the laboratory's own copy of the certificate, and every check set down below was run at source today rather than carried forward from the 2026-09-05 entries. The public product API answered HTTP 200 to a cookieless request at 17:16 UTC with 42 rows and 34 distinct product names. Three rows carry a certificate pointer and exactly two carry the coaVerifyUrl field the new control is built from, BP-TR2 10mg pointing at https://coas.freedomdiagnosticstesting.com/Bana2606150217.pdf and BP-RT3 10mg at https://coas.freedomdiagnosticstesting.com/Bana2607230210.pdf. This record's 2026-09-05 entry found a single certificate pointer shared across seventeen dose rows of those same three products; the extra dose rows are gone from the catalogue today, and BP-RT3, BP-TR2 and GHK-Cu each answer with one row. The three product pages are one shell and the panel is assembled in the reader's browser from that API row, so what the field decides was read in the served document itself at 17:18 UTC: where coaVerifyUrl is set, the panel prints a second control beside View COA, whose title reads Verify at followed by the vendor's own laboratory string and an arrow glyph, whose subtitle reads Opens the certificate on the laboratory's own site, and which opens in a new tab under rel noopener noreferrer. That control opens the laboratory's copy of the document rather than the laboratory's lookup page, so it is not the link to a laboratory verification page that this publication's Verify link criterion counts, and the same reading was applied to Secra Labs on 2026-08-24, whose five laboratory-hosted documents at this same host are recorded without that criterion. The laboratory string is printed unmodified, so the control reads Verify at Freedom DiagnosticsTesting.com on the BP-TR2 page and Verify at FREEDOM DIAGNOSTICS on the BP-RT3 page, and the naming inconsistency this record set down on 2026-09-05 is now printed twice in the same panel, once in the Tested by row and once in the new control's own title. The renderer emits that control only where a certificate is published and only where the field is set, so the GHK-Cu page prints View COA alone. Those three panels were also read as rendered between 17:36 and 17:40 UTC, in a browser holding no account and with nothing clicked: the BP-TR2 panel prints Purity 99.78% by HPLC-UV, Tested by Freedom DiagnosticsTesting.com, Batch Black Cap and COA date Jun 17, 2026, then View COA and a second control titled Verify at Freedom DiagnosticsTesting.com followed by the arrow, pointing at the Bana2606150217 file; the BP-RT3 panel prints Purity 99.81% by HPLC-UV/MS, Tested by FREEDOM DIAGNOSTICS, Batch 626 and COA date Jul 27, 2026, then View COA and a second control titled Verify at FREEDOM DIAGNOSTICS, pointing at the Bana2607230210 file; and the GHK-Cu panel prints Purity 99.82% by HPLC-UV/MS, Tested by Freedom Diagnostics, Batch 0726 and COA date Aug 21, 2026, then View COA and nothing beside it. Both linked documents were pulled from the laboratory host at 17:15 UTC, one request each with an identifying user agent, and read in full. Each prints the laboratory as FreedomDiagnosticsTesting.com in the masthead and again in the footer above the line Proudly Owned and Operated in the USA, each prints the address Admin@FreedomDiagnostics.net, and each is signed Principal Chemist over a signature graphic that carries no text layer. Each names its client as Banana Peppers LLC, the operating entity the storefront publishes. The BP-TR2 document is Accession # 2606150217, Search Code Bana2606150217, sample BP-TR2 10mg, Received 06/15/2026 and Reported 06/17/2026, and its Analytical [Findings] table prints the row Identity (LC-MS) against GLP TZ, the row Purity (HPLC-UV) against 99.78%, and the row Net Content against 10.31 mg, with the method spelled out separately lower on the same page as HPLC with UV detection coupled with mass spectrometry (LC-MS), which makes the figure 99.78% purity by HPLC with UV detection. It adds Endotoxin Replicate 1 Pass and Endotoxin Replicate 2 Pass, each printing Assay Sensitivity: ≤0.05 EU/mL, under a method line reading Endotoxin testing performed using Limulus Amebocyte Lysate assay in accordance with USP <85> under validated laboratory conditions. The BP-RT3 document is Accession # 2607230210, Search Code Bana2607230210, sample BP-RT3 10mg, Received 07/23/2026 and Reported 7/27/2026, the second date printed without the leading zero the first carries, and its table prints Identity (LC-MS) against GLP RT, Purity (HPLC-UV) against 99.81%, and Net Content against 11.56 mg under the same separately printed method note, which makes the figure 99.81% purity by HPLC with UV detection. It adds the line Microbial Analysis (PCR): Pass in its sample summary and a table row reading Microbial Analysis (PCR) against No Detectable Microbial DNA, under a method line reading Microbial detection performed using validated polymerase chain reaction (PCR)-based assay targeting common microbial contaminants. The BP-TR2 document prints lot Black Cap and the BP-RT3 document prints lot 626, and each product panel prints that same value in its own row beside the purity figure, under the label Batch. Neither document carries the other's panel: no endotoxin line appears on the BP-RT3 certificate and no microbial line on the BP-TR2 one, and neither says the missing panel was skipped rather than never ordered. Neither prints the compound term HPLC-UV/MS that the BP-RT3 panel prints as its method, though both print the longer method note that term compresses. Both foot disclaimers state that the peptides tested are intended for research use only and are not approved for human or veterinary use, diagnostic, therapeutic, or clinical applications. A reader who never loads the storefront can reach the same documents through the laboratory's own tooling, and that route was exercised today rather than assumed. The laboratory's lookup page, read at 17:17 UTC, documents its Search Code as the first 4 characters of your company name followed by your accession number, which is the Bana-prefixed form printed on all three of this vendor's certificates, and the page's own script builds every document address from a constant reading https://coas.freedomdiagnosticstesting.com. The index endpoint that page queries answered HTTP 200 at 17:15 UTC to a company query for Banana Peppers and returned three file names, Bana2606150217, Bana2607230210 and Bana2608140890. The whole index, pulled at 17:16 UTC, held 63,899 entries, of which those same three carry the four-character company prefix. The two linked files answered HTTP 200 at 277,899 bytes with md5 d5f83d7cb7d05ebaa9d4644b343f0cb5 and at 289,870 bytes with md5 4fa2e692dfb605434f7e130e0e38b6b1, and the vendor's own coa-file endpoint returned those same two md5 figures at those same byte counts to a cookieless request in the same minute, so the new control opens a document identical to the one the vendor was already serving rather than a second, different one. Both md5 figures match what this record set down on 2026-09-05, so neither copy moved in the interval. What the new control does not settle is set down plainly, because two checks share a word and are not the same check. Confirming a document at the laboratory's own host shows that the certificate is the laboratory's own, and says nothing about whether any body has assessed the laboratory. No accreditation number is printed on any of the three certificates. No accrediting body is named on any of them. No A2LA, ISO 17025 or CLIA claim appears in text a reader sees on the laboratory's homepage or on its lookup page, both read at 17:17 UTC. The lookup page still carries two unbodied bands reading Compliant with ISO 9001 / Quality Management Principles and Good Laboratory Practice (GLP) / Quality Standard Principles, neither naming a certifying body and neither printing a certificate number, so there is still no register a reader can check. The address printed on all three certificates, Admin@FreedomDiagnostics.net, sits on a domain that returned no A record and no AAAA record from a public resolver at 17:17 UTC, while the same domain returned five mail exchanger records at preferences 1, 5, 5, 10 and 10, all of them Google hosts, so it publishes a mail route while publishing no web host, and it is a different domain from the laboratory's working freedomdiagnosticstesting.com. Mail to that address was not sent, so whether anyone reads it is not observed here. Coverage of the new control did not widen beyond those two listings: the GHK-Cu listing carries no such control, nor does any other listing in the catalogue, so two of the catalogue's 42 rows offer one. The third certificate itself has moved, and this record's earlier finding about it is superseded rather than repeated. On 2026-09-05 this record set down that the GHK-Cu accession answered HTTP 404 at the laboratory host and appeared in no entry of the laboratory's index. Read at 17:15 UTC today, https://coas.freedomdiagnosticstesting.com/Bana2608140890.pdf answered HTTP 200 at 276,595 bytes with md5 f3c46b41c290692b13061dd3be91916c, and its Last-Modified header reads Mon, 07 Sep 2026 16:36:24 GMT, so the document was written to that host earlier on the same day this entry was fetched. The accession is in the laboratory's index today, in the company query and in the whole index alike. The document prints Accession # 2608140890, Search Code Bana2608140890, client Banana Peppers LLC, sample GHK-Cu 10mg, Received 8/14/2026, Reported 8/21/2026, Identity reading Confirmed, Appearance Blue Lyophilized Powder, Purity (HPLC-UV) against 99.82% and Net Content against 99.33 mg under the same separately printed method note, which makes the figure 99.82% purity by HPLC with UV detection, and it prints lot 0726. It carries no endotoxin panel and no microbial panel. Its extracted text is identical to the copy the storefront serves at its own coa-file endpoint, while the two files differ in size, 276,595 bytes against 214,907, so the laboratory's copy is a re-rendering of the same document rather than a different one. The sample it names is GHK-Cu 10mg while the SKU it is filed against, GHKCU-100MG-V, names a 100mg size, which is the size mismatch this record set down on 2026-09-05 and which the laboratory's copy does not resolve. What has not moved is the storefront: that row still carries no coaVerifyUrl, so a reader who wants the third document at the laboratory's own host has to search the accession there without help from the product page. The panel's own scope sentence is printed unchanged today and reads: Purity is reported by HPLC; where the method lists MS, mass confirmation is reported as well. Sterility and endotoxin are not tested unless the certificate states it. That sentence is conditional, so no certificate contradicts it, but the panel prints neither the BP-TR2 document's endotoxin passes nor the BP-RT3 document's microbial line, so following the new link is the only way a reader on the product page learns either fact. The account picture did not move either. The served document's own guest list, read at 17:18 UTC, admits gate, terms, privacy, shipping-policy, about, track-page and product, and does not admit shop or coa-library, so those two destinations still open a sign-in prompt, while the individual product page, its certificate panel and both of its links stay open to a signed-out reader. The vendor's viewer at https://www.bananapeps.com/coa/bp-tr2 and its bp-rt3 twin each answered HTTP 200 at 3,657 bytes to a cookieless request at 17:18 UTC, the coa-file endpoint answered HTTP 200 for all three published certificates in the same minute, and an unknown slug answered HTTP 404. The synchronous block that raises the click-through age attestation still exempts only /privacy and /terms, so a first-time reader meets that overlay before the panel, and the config endpoint read at 17:18 UTC still carries ageVerification false, the same value this record read on 2026-09-05. No order was placed, so what happens at checkout is not observed here. Prices were read in the same API response at 17:16 UTC, and the identification of both compounds is inferred from house code and category rather than stated by the vendor. The listing this record benchmarks as retatrutide 10mg is BP-RT3 10mg, SKU GLP3RT-10MG-V, at $24.99 against a regular price of $29.99 with the sale flag set and 196 units in stock. The listing that answers to tirzepatide 10mg is BP-TR2 10mg, SKU GLP2TR-10MG-V, at $19.99 against a regular price of $24.99 with the sale flag set and 147 units in stock. The words retatrutide and tirzepatide are absent from the product API in every casing, absent from all three served product documents and absent from all three certificates, re-checked at source today.

Fetched today, 2026-09-07. The storefront changed a second time after the entry above was written, and every fact set down here comes from fetches made after that change rather than from the earlier reading. The public product API answered HTTP 200 to a cookieless request at 23:46 UTC, 13,573 bytes, still 42 rows and 34 distinct product names. Three rows now carry the coaVerifyUrl field the certificate panel's laboratory controls are built from, one more than the two the entry above found at 17:16 UTC: BP-TR2 10mg, SKU GLP2TR-10MG-V, pointing at https://coas.freedomdiagnosticstesting.com/Bana2606150217.pdf; BP-RT3 10mg, SKU GLP3RT-10MG-V, at https://coas.freedomdiagnosticstesting.com/Bana2607230210.pdf; and GHK-Cu, SKU GHKCU-100MG-V, at https://coas.freedomdiagnosticstesting.com/Bana2608140890.pdf. The GHK-Cu row is the new one, and the gap this record set down earlier today, that a reader wanting the third document at the laboratory's own host had to search the accession there without help from the product page, is closed. The three product pages are one shell and the panel is assembled in the reader's browser from that API row, so the renderer was read in the served document itself, pulled at 23:46 UTC at 580,615 bytes. Beside View COA and the Verify at control the entry above recorded, the panel now emits a third control. Its title reads Look it up at Freedom Diagnostics followed by an arrow glyph, with a non-breaking space in front of the arrow. Its subtitle reads Search code, then the code, then the sentence Opens the laboratory's lookup page, where you enter it. Its address is https://freedomdiagnosticstesting.com/search-for-your-coa-based-on-the-unique-accession-number/, it opens in a new tab, and it carries rel noopener noreferrer. Two conditions decide whether it renders at all, and both were read in the script rather than inferred. The host of the certificate address must match a key of the renderer's LAB_LOOKUP_PAGES map exactly, lowercased with one trailing dot tolerated, and that map holds one key today, coas.freedomdiagnosticstesting.com, whose entry names the laboratory Freedom Diagnostics and carries the lookup address above. The script's own comment states that an address which merely ends with a mapped host is a different host, and the function refuses outright an address carrying a query, a fragment or userinfo. The code is then derived from the file name and from nothing else: the map's own function takes the last path segment, accepts the pattern ^([A-Za-z0-9][A-Za-z0-9_-]{0,39})\.pdf$ case-insensitively, and hands back the name without its .pdf extension, so Bana2607230210.pdf yields Bana2607230210 while anything else yields an empty string and the control does not render. The code is printed as selectable text and is never appended to the address, and the comment beside it states that the laboratory's box takes the code by hand and by hand only, so a code stitched into a link that ignored it would be a promise the link does not keep. Those three panels were also read as rendered between 23:48 and 23:49 UTC, in a browser holding no account and with nothing clicked, and each prints three controls where two stood this afternoon. The BP-RT3 panel prints Purity 99.81% by HPLC-UV/MS, Tested by FREEDOM DIAGNOSTICS, Batch 626 and COA date Jul 27, 2026, then View COA, then Verify at FREEDOM DIAGNOSTICS, then Look it up at Freedom Diagnostics over the subtitle Search code Bana2607230210. Opens the laboratory's lookup page, where you enter it. The BP-TR2 panel prints Purity 99.78% by HPLC-UV, Tested by Freedom DiagnosticsTesting.com, Batch Black Cap and COA date Jun 17, 2026, then the same three controls, the second reading Verify at Freedom DiagnosticsTesting.com and the third carrying Search code Bana2606150217. The GHK-Cu panel prints Purity 99.82% by HPLC-UV/MS, Tested by Freedom Diagnostics, Batch 0726 and COA date Aug 21, 2026, then the same three, the third carrying Search code Bana2608140890. The third control takes its laboratory name from the map rather than from the vendor's stored string, so it reads Freedom Diagnostics on all three pages while the Tested by row above it still prints three different spellings of the same laboratory, and the naming inconsistency this record set down on 2026-09-05 is unchanged in the rows above the controls. The COA Library card carries the same route in a quieter form, an inline link reading Look it up at the lab with the code printed beside it under a title attribute reading Opens the laboratory's lookup page, where you enter the search code. That wording is taken from the renderer in the served document rather than from the card as rendered, because the served document's guest list still admits gate, terms, privacy, shipping-policy, about, track-page and product and still does not admit coa-library, so a signed-out reader meets a sign-in prompt at that card. The laboratory's page was read once, at 23:47 UTC, HTTP 200 at 164,993 bytes, and no form on it was filled in or submitted from here. It is headed Certificate of Analysis Lookup over the line Search by your Search Code, Accession Number, or Company Name, and it offers two tabs, one labelled Search Code / Accession # and one labelled Company Name. The first holds a text box capped at 40 characters and a button reading Look up, under instructions to find the Search Code field in the top right table of the certificate, where it is labeled exactly as Search Code, and stating that the Search Code is always the first 4 characters of your company name followed by your accession number, with a worked example splitting ABCD from 2603170030. That is the Bana-prefixed form printed on all three of this vendor's certificates and the form the storefront now prints beside its new control. The second tab holds a box asking for the full company name exactly as it appears on the certificate. The page's own script builds every document address from a constant reading https://coas.freedomdiagnosticstesting.com, the same host all three of the storefront's certificate addresses point at, and offers an Open PDF control against that address once a code resolves. The route behind the box has itself moved today: a comment in that script, marked W1 2026-09-07, states that the code lookup is resolved server-side at /lookup?code=, one code in and at most one match out, and that the page no longer downloads the bucket listing, which supersedes the whole-index route this record exercised at 17:16 UTC. What that amounts to for this publication's seventh criterion is stated plainly here rather than left to be inferred. The storefront now offers a verification link beside the certificate on each of those three product pages: the control opens the laboratory's own verification page, which is the page a reader types a code into, and the Search Code to enter is printed next to it. That is the link to a laboratory verification page the Verify link criterion asks for, so the criterion is met on this date. The entry above stands as written and is not amended. On the reading taken at 17:18 UTC the panel offered the laboratory's copy of the document and no route to the laboratory's own lookup page, and that was true of the storefront as it stood at that hour; this entry supersedes it by date rather than by correction. What the new control does not settle is unchanged, and is repeated here so that two checks sharing a word are not read as one. Reaching a certificate through the laboratory's own tooling shows whose document it is. It shows nothing about whether any body has assessed the laboratory. No accrediting body is named on the lookup page, no accreditation number is printed on it, and the two unbodied bands reading Compliant with ISO 9001 / Quality Management Principles and Good Laboratory Practice (GLP) / Quality Standard Principles stand there today as before, neither naming a certifying body and neither carrying a certificate number, so there is still no register a reader can check. The same reading that governed the earlier control still governs Secra Labs, whose laboratory-hosted documents at this same host reach files rather than a lookup page, so nothing here moves that record. Coverage is three of the catalogue's 42 rows and no wider: no other listing carries the field, and the evidence block above, written before this change, records two.

Fetched today, 2026-09-05. https://www.bananapeps.com answered HTTP 200; the bare domain https://bananapeps.com answered HTTP 301 to the www address the same day. Local storage and cookies were cleared first so the page would render as a first-time visitor sees it (an earlier load in the same browser profile had a prior bp_age_gate_ok value already sitting in local storage from before this dossier's fetches, which was cleared before recording the gate). One quotation convention runs through this record: where a vendor or laboratory string uses a word this publication's language rails do not carry, the substituted word appears in square brackets, and the bracketed word is ours while the words around it are theirs. With state cleared, the site opens on a full-screen modal reading: BANANA PEPPERS LLC / LABORATORY RESEARCH COMPOUNDS / Welcome. Serious work does not require a serious name. There is a short story behind ours. / You must be 21 years of age or older to enter this site. / All products are for laboratory research use only, not for human or veterinary consumption, diagnostic, or therapeutic use. It carries one checkbox, I am 21 or older and confirm these products are for research and laboratory use only, a button reading I AM 21 OR OLDER, and an EXIT link. Checking the box is a self-attestation with no age or identity check attached to it at the door, and that self-attestation is the whole of the live mechanism today. The gate's markup carries one further sentence, Age will be verified at checkout, which no visitor sees: https://www.bananapeps.com/api/config, fetched today, 2026-09-05, returns ageVerification false and carries the AgeChecker key only as an empty string (the configuration values are described by their state and are not reprinted here), so the loader's enabling branch never runs and the document element is toggled into an av-off state against the stylesheet rule that hides every element carrying the av-only class. The served document does carry AgeChecker.Net copy, and every detail of it that this record quotes is quoted accurately, including a Privacy Policy passage stating that identity and age verification is performed at checkout by that named third party and that the store receives back only a verification reference ID and a pass or fail status, not the underlying identity documents or biometric data. Every one of those passages sits inside an av-only element and none of it is visible to a visitor while the integration is switched off, so this record does not carry any of it as live published policy; the eight suppressed elements are enumerated in the Privacy Policy entry below, counted with node against the served document rather than by eye. While the integration is off, the storefront's verification passages are suppressed and a single paired av-off-only element appears only in that state, carrying the checkout line By placing this order, you confirm you are of legal age to purchase these products in your jurisdiction. The live customer-facing flow today is attestation end to end and says so. Past the gate, the homepage headline reads Research Compounds, Done Right, subhead Published COAs, transparent labeling, and U.S. shipping, with four badges: Published Third-Party COAs, U.S. Fulfillment, Price-Match Guarantee, Research Use Only. A Why Banana Peppers section states: Independent, third-party testing is expanding across our catalog, and [findings] are reported per batch and by method, not as a blanket catalog claim. A Based in Colorado, USA tile states: Banana Peppers is a Colorado-based operation. Orders ship from the United States with tracking, support is U.S.-based and answers technical questions before you buy. The page-wide disclaimer reads: These statements have not been evaluated by the Food and Drug Administration. All products are strictly for laboratory research and identification purposes only. Not for human or veterinary consumption, injection, ingestion, diagnostic, or therapeutic use. You must be 21+ and purchasing for legitimate research purposes to order. The title tag reads Research Peptides | Selank, Semax, GHK-Cu | Banana Peppers and the meta description reads U.S.-based research peptides. Third-party COAs published as testing completes. Selank, Semax, Epitalon, GHK-Cu, KPV & more. Research use only. 21+.

Read live today, 2026-09-05. The Shop and the COA Library both sit behind a mandatory account from the top navigation: clicking either link opens a Sign In / Create Account modal carrying the banner An account is required to view the catalog, and the FAQ answer to How do I order, and why create an account? states the same thing in the vendor's own words: Create a free account to view the full catalog and place an order. No account was created and no credentials were entered for this record. The wall's exact shape was read from the served document's own gate map on 2026-09-05: a GUEST_OK list names gate, terms, privacy, shipping-policy, about, track-page and product, and the guard opens the auth modal only for a page id outside that list, so the walled set is Shop, COA Library, Account, Subject Log and Affiliate, while individual product pages, the Terms of Service, the Privacy Policy and the Shipping policy are all guest-open by the site's own configuration. The catalog and certificate data reported here came from two sources that require no login: the page markup the server sends on first load, which already contains the full shop grid and the coa-library header populated by client-side script regardless of sign-in state and was read directly from the page's own DOM, and the store's own public product API at https://www.bananapeps.com/api/products, which answers a plain HTTP GET with no session cookie. So the sign-in prompt found on the two nav links is a client-side navigation guard, not a server-side restriction on the underlying catalog data or the certificate files themselves, which are described in the next entry. The API was fetched today by curl and counted with node, not by eye: curl -s -o bp_products.json https://www.bananapeps.com/api/products returned HTTP 200 and 20,894 bytes; the saved file holds 66 total entries and 3 entries with a non-null purity object. The 66 entries are 66 SKU-and-dose combinations across 35 uniquely named products; the shop page's own DOM, read the same way, renders 35 product cards, one per name, of which 15 carry an IN STOCK badge and 20 carry OUT OF STOCK, consistent with 15 of the 66 SKU-dose entries carrying status in_stock and 51 carrying out_of_stock in the API. Two counts over this data must not be conflated, because conflating them is how the companion walkthrough went wrong: 51 rows are out of stock, and a different 35 rows carry a null price. They are not the same set. The three entries with a purity object are BP-RT3 10mg (SKU GLP3RT-10MG-V), BP-TR2 10mg (SKU GLP2TR-10MG-V), and GHK-Cu 100mg (SKU GHKCU-100MG-V). Every other entry, including every other dose size of those same three products, carries purity: null, and its product card states COA NOT YET PUBLISHED in place of a purity line, matching the wording the homepage and About page both use: a product without a published certificate says so on its page.

Certificates read today, 2026-09-05, three in total, matching the three non-null purity entries above; no fourth certificate exists in the API or the DOM. Each product page shows a Certificate of Analysis block with four labeled fields (Purity, Tested by, Batch, COA date) plus a View COA control; the same wording appears on all three pages: Purity is reported by HPLC; where the method lists MS, mass confirmation is reported as well. Sterility and endotoxin are not tested unless the certificate states it. The three purity labels quoted exactly as the STOREFRONT printed them on the morning of 2026-09-05, which is not how the certificates print them: BP-RT3 10mg, Purity >=99.81% by HPLC-UV/MS, Tested by FREEDOM DIAGNOSTICS (all capitals, as rendered on the page), Batch 626, COA date Jul 27, 2026; BP-TR2 10mg, Purity >=99.78% by HPLC-UV (no MS on this one), Tested by Freedom DiagnosticsTesting.com (rendered on the page exactly this way, the lab's own domain name run together with no space where a lab name would otherwise sit), Batch Black Cap, COA date Jun 17, 2026; GHK-Cu 100mg, Purity >=99.82% by HPLC-UV/MS, Tested by Freedom Diagnostics, Batch 0726, COA date Aug 21, 2026. The greater-than-or-equal operator in all three of those labels was the storefront's own addition, printed at the head of each purity label by the API and by the pages as read on the morning of 2026-09-05 and stored in the API as a U+2265 character at the head of the label string; the certificates print flat measured figures with no operator at all, and that difference is recorded on its own below. So the Tested by field on the three product pages prints one laboratory's name three different ways. The inconsistency belongs to the storefront's catalogue data and not to the certificates, which is a different finding about a different party: the three strings are exactly what the public product API carries inside its purity objects, the product page prints that field unmodified, and all three certificate files carry one identical letterhead whose logo and signature graphics are byte-identical between the files. View COA resolves to https://www.bananapeps.com/coa/, a pdf.js viewer page (right-click disabled, and the viewer page itself carries robots noindex and nofollow plus a for-reference-only header) that pulls the underlying file from https://www.bananapeps.com/api/products/coa-file/; that endpoint was fetched directly by curl today with no session cookie and answered HTTP 200 for all three slugs (bp-rt3: 289,870 bytes; bp-tr2: 277,899 bytes; ghk-cu: 214,907 bytes), while an unknown slug answers 404, so the endpoint is not a catch-all. All three PDFs share one letterhead, Freedom Diagnostics, printed as FreedomDiagnosticsTesting.com / Admin@FreedomDiagnostics.net, and one signature block reading Alex Johnson, Principal Chemist, Proudly Owned and Operated in the USA; the signatory's name is a graphic rather than text, since the extracted text layer of all three carries the words Principal Chemist while the name appears in none of them. BP-RT3 certificate: Accession # 2607230210, Search Code Bana2607230210, Received 07/23/2026, Reported 7/27/2026, Lot 626, Product BP-RT3 10mg, Purity 99.81%, Identity Confirmed, Net Content 11.56 mg, Appearance White Lyophilized Powder, Identity (LC-MS) reads GLP RT, Microbial Analysis (PCR) No Detectable Microbial DNA (method stated as a validated polymerase chain reaction based assay targeting common microbial contaminants); no endotoxin or sterility-by-USP line appears. BP-TR2 certificate: Accession # 2606150217, Search Code Bana2606150217, Received 06/15/2026, Reported 06/17/2026, Lot Black Cap, Product BP-TR2 10mg, Purity 99.78%, Identity Confirmed, Net Content 10.31 mg, Appearance White Lyophilized Powder, Identity (LC-MS) reads GLP TZ, Endotoxin Replicate 1 Pass and Replicate 2 Pass, each of those two lines printing Assay Sensitivity: 0.05 EU/mL with no comparison operator anywhere before the figure, method stated as Endotoxin testing performed using Limulus Amebocyte Lysate assay in accordance with USP <85> under validated laboratory conditions; no microbial or PCR line appears on this one. The missing operator is not cosmetic and the earlier form of this note had it backwards in the direction that flattered the document: an assay sensitivity is the stated detection limit of the method, whereas writing it with a less-than-or-equal sign reads as a specification the batch met, which is a stronger claim than the laboratory makes. Re-derived at source on 2026-09-05 from the file curl saved cookieless, by pdftotext -layout, and the two extracted lines are plain ASCII; the extracted text layer of all three certificates contains no U+2264, no U+2265, no <= and no >=. The raw bytes of all three PDFs do contain the ASCII sequences <= and >= inside the binary and compressed regions any PDF carries, so a raw-byte scan of a PDF is not evidence about what a document prints in either direction and is not offered here as corroboration. GHK-Cu certificate: Accession # 2608140890, Search Code Bana2608140890, Received 8/14/2026, Reported 8/21/2026, Lot 0726, Product GHK-Cu 10mg, Purity 99.82%, Identity Confirmed, Net Content 99.33 mg, Appearance Blue Lyophilized Powder, Identity (LC-MS) reads GHK-Cu; no endotoxin, sterility, or microbial line appears. Two things on this last certificate are worth recording without inference: its own Sample Summary names the product GHK-Cu 10mg while its measured Net Content, 99.33 mg, sits near what a 100mg-labeled vial would show at full content rather than a 10mg vial; and the public product API attaches this identical file (ghk-cu.pdf) to both the 50mg and the 100mg GHK-Cu listings, so the certificate's own printed dose, 10mg, does not match either size it is attached to, and no GHK-Cu 10mg row exists anywhere in the catalogue. Separately, on all three product lines, the same coaFile pointer is attached to every dose size regardless of whether that size has been tested: bp-rt3.pdf sits on all eight BP-RT3 dose entries (10mg through 100mg), bp-tr2.pdf on all seven BP-TR2 dose entries (10mg through 90mg), and ghk-cu.pdf on both GHK-Cu dose entries, seventeen rows in all, but the populated purity figure, method, batch, and lab sit on exactly one dose per family, the 10mg entry for BP-RT3 and BP-TR2 and the 100mg entry for GHK-Cu; every other dose in those three families links the identical certificate file with no purity figure of its own in the data. Last, each certificate names its purity method three ways on the same document: the table headed Analytical [Findings] carries Identity (LC-MS), Purity (HPLC-UV) and Net Content as its rows, so the bare header reads Purity (HPLC-UV) on all three; a separate method note on each states HPLC with UV detection coupled with mass spectrometry (LC-MS); and a foot disclaimer on each states that the analysis was conducted using LCMS/MS, which is tandem mass spectrometry. The BP-RT3 and GHK-Cu product pages follow the fuller method note (HPLC-UV/MS) in their own purity label, while the BP-TR2 product page follows the bare table header (HPLC-UV) instead. That is an inconsistency in which of the certificate's own method statements the storefront copies onto the product page, and the BP-TR2 page takes the narrower of the two: the bare table header, Purity (HPLC-UV), rather than the method note printed on the same document, HPLC with UV detection coupled with mass spectrometry (LC-MS). Re-fetched the same evening, which makes the operator finding above a dated observation and not the state of the site tonight: at 16:48 MDT on 2026-09-05 (22:48 UTC) curl returned https://www.bananapeps.com/api/products at HTTP 200 and 20,885 bytes, nine bytes shorter than the 20,894 read that morning, and node counted zero U+2265 characters in the saved file. The three labels now read 99.81% by HPLC-UV/MS, 99.78% by HPLC-UV and 99.82% by HPLC-UV/MS, with no operator at the head of any of them. The site root and the product pages, re-fetched at 16:49 MDT (22:49 UTC), grew by 1,898 bytes each and carry no U+2265 either, and the FAQ's only worked example now prints the parenthetical for example, 99.81% by HPLC-UV/MS, batch 626, which is the BP-RT3 figure and its lot 626 rather than the GHK-Cu figure. The vendor changed these the same day, and this record does not claim to know why.

Read today, 2026-09-05, from the site's own Shipping & Refunds page (the page prints its own [in force] date as June 12, 2026) and the checkout page (cart empty, no order placed, no account signed in). Confirmed orders ship within 1-2 business days with tracking emailed. Orders of $1,000.00 or more of product, calculated before shipping, account credit, and discount codes, ship with adult signature required, 21 or older at delivery; the carrier will not leave the package unattended, cannot release it to a minor, and will attempt redelivery or hold it for pickup with photo ID if nobody can sign. Lyophilized compounds are stated to be stable at ambient temperature during transit and are held in cold storage until they ship; post-receipt storage guidance given is -20 C for long-term stability or 4 C for short-term use, protected from light and moisture, with a note that where a COA has been published for a compound, follow the handling conditions listed on it. Returns and refunds: ALL SALES ARE FINAL ONCE SHIPPED is stated in capitals at the top of the page and again in the Returns & Refunds section; the stated exception process is to contact the vendor within 5 business days of delivery with photographic evidence for a wrong item, a visibly damaged item, or a demonstrably defective item, with a replacement or credit issued at the vendor's sole discretion; approved refunds go to the original payment method within 5 to 10 business days of approval. Orders may be cancelled for a full refund any time before shipment, and an unpaid order may itself be cancelled after 7 calendar days (Payment-First Fulfillment: payment is collected at checkout before an order is processed). Lost packages: if tracking shows no movement for 7 days, the vendor opens a carrier investigation and replaces or refunds as appropriate. A Jurisdictional Restrictions clause reserves the right to refuse shipment where local law restricts receipt of research compounds, cancelling and refunding such orders. A California Civil Code section 1723 refund disclosure is made in two places, not one: in the Shipping & Refunds banner, and again in the Terms of Service refund clause immediately before the Indemnification heading, where an italicised line states that California residents are disclosed this policy at checkout consistent with the same section. Both instances print the section symbol rather than the word section. This record claims nothing about what that statute requires; the statute itself was not fetched. On payment marks, the earlier form of this note undercounted them and asserted an absence that is not there. The checkout row labelled WE ACCEPT, which occurs exactly once in the served document, and the footer row under the PAYMENT heading are filled by one and the same generated string, so the two can never disagree, and that string carries five marks: Visa, Mastercard, American Express, Discover and Google Pay. Mastercard is present and accepted. The badge builder is an unconditional template literal with no branching, and one DOMContentLoaded handler writes the identical markup into both the footer element and the checkout element. The reason the miscount happened is worth recording so it is not repeated: four of the five badges draw a word, while the Mastercard badge is two overlapping SVG circles with no text node at all, so its only machine-readable identifier is its title attribute, and a text scrape of the rendered page finds four names against five marks. Re-derived at source on 2026-09-05 by matching title attributes in the served document rather than the drawn words. Prices recorded from the public product API today, in-stock items only: BP-RT3 10mg $24.99 against a struck-through $29.99, BP-TR2 10mg $19.99 against $24.99, GHK-Cu 100mg $24.99 against $45.00, 5-Amino-1MQ 50mg $49.99 against $60.00, AHK-Cu 100mg $29.99 against $50.00, Adamax 10mg $29.99 against $40.00, BP-31 10mg $29.99 against $39.99, BP-SM1 10mg $24.99 against $38.00, BP-Tes 10mg $49.99 against $59.99, BPC-157 10mg $29.99 against $39.99, Cagrilintide 10mg $54.99 against $60.00, KPV 10mg $29.99 against $39.99, MOTS-C 10mg $29.99 against $39.99, NAD+ 1000mg $49.99 against $62.99, Sermorelin 10mg $39.99 against $45.00; all fifteen in-stock items show a marked-down price against a higher struck-through price today. Twenty of the thirty-five named products are out of stock today. The price picture, re-derived with node on 2026-09-05 against the API response curl saved rather than read by eye: 66 rows, 51 of them out of stock, and 35 of them carrying a null price, two different sets. Fourteen named products have every one of their rows null-priced, and they are AOD-9604, DSIP, Glutathione, IGF-1 LR3, Kisspeptin, LL-37, MT-1, MT-2, Oxytocin, PT-141, TB-4 Fragment, TB-500, Thymosin Alpha-1 and VIP. GLOW and KLOW are not among them and the earlier form of this note was wrong to list them as unpriced: each of those two names has exactly one row and both rows carry a price, GLOW 70mg at $40.00 and KLOW 80mg at $88.00, both out of stock. Epithalon is not among them either, and its two rows split, Epithalon 10mg priced at $12.00 while Epithalon 50mg is null, so the unpriced item there is a dose and not a product name. Sixteen out-of-stock rows carry a price, not six: Cagrilintide 5mg $40.00, Epithalon 10mg $12.00, GHK-Cu 50mg $29.00, GLOW 70mg $40.00, BP-TR2 15mg $67.00, BP-TR2 20mg $83.00, BP-TR2 30mg $120.00, BP-RT3 15mg $55.00, BP-RT3 20mg $65.00, BP-RT3 30mg $80.00, BP-RT3 60mg $120.00, Ipamorelin 10mg $30.00, KLOW 80mg $88.00, Selank 10mg $25.99 against a struck-through $39.99, Semax 10mg $24.00, and BP-Tes 20mg $80.00. Every one of those sixteen except Selank 10mg lists the same figure for its price and its regular price, so the marked-down pricing sits almost entirely on the in-stock rows. Four of the sixteen are further BP-RT3 doses carrying public list prices, which matters to this corpus because it puts three more points on the benchmark axis beside the 10mg row.

Read today, 2026-09-05, from the site's own Privacy Policy (the page prints its own [in force] date as September 4, 2026) and About page; no account or order was needed to read either. The Privacy Policy names the operating address as Banana Peppers LLC, PO Box 717, Firestone, CO 80520, and names four processors: card payments through Elavon, with the policy stating card numbers never touch the vendor's own servers; identity and age verification at checkout through AgeChecker.Net, with the policy stating the vendor receives back only a verification reference ID and a pass or fail status, not the underlying identity documents or biometric data; a live chat widget from tawk.to, which the policy states loads on every page once it finishes loading, not only when the chat is opened, setting a visitor-tracking cookie and browser storage before any message is typed, a behavior the policy says it checked on this site itself on September 4, 2026; and Google Analytics 4, which the policy states is configured with IP address truncation, no ad-personalization signals, and automatic page-view pinging turned off. The policy names those four processors individually, with one exception recorded in its own entry below: a fifth third-party service loads on every page and the policy names it only in general terms. On the tawk.to relationship specifically, the policy quotes tawk.to's own site-wide privacy policy as stating it works with third-party advertising partners including Google, Microsoft, Meta, YouTube, and LinkedIn, and states plainly that tawk.to's policy does not say whether those partners receive data collected by the widget on customer sites like this one; the same section states that whether this arrangement counts as a sale or share of personal information under state privacy law is under legal review. On the AgeChecker.Net bullet, see the conditional-visibility finding below: that bullet is one of the eight elements the site hides while identity verification is switched off. Section 8 of the policy carries a Colorado HB24-1130 biometric data retention policy, stating that the vendor does not itself collect or store biometric identifiers or biometric information, that AgeChecker.Net performs any biometric processing under its own policy, and that the vendor retains only the verification reference ID, for up to three years from the most recent transaction, deleted within 90 days after that period ends. The whole of Section 8 is wrapped in a single av-only div and is therefore invisible to every visitor today, so this record carries it as conditional copy rather than as the vendor's live published policy. Reading that section out of the page source without also reading https://www.bananapeps.com/api/config gets the vendor's posture backwards, which is what the earlier form of this note did. The eight elements carrying the av-only class in the served document, counted with node on 2026-09-05 against the file curl saved rather than read by eye, are: the age gate's line that age will be verified at checkout; a Research Account Status call to action stating that ID verification at checkout gives a +1 order credit toward the next tier; the homepage trust tile headed Age-Verified Checkout, whose body states that 21+ identity verification is required at checkout with no exceptions; the Terms of Service eligibility sentence that third-party identity and age verification is used at checkout and orders that cannot be verified will be rejected; the Privacy Policy Age & identity verification block in Section 2; the Identity and age verification providers bullet in the processors list; the whole of Section 8; and a checkout note reading First order? A one-time age check (21+) runs when you place your order. It is handled by AgeChecker.Net. Exactly one element carries the paired av-off-only class, which shows only while verification is off, and it carries the checkout line By placing this order, you confirm you are of legal age to purchase these products in your jurisdiction. The suppression reaches the checkout surface itself and not only marketing and policy copy, and the age gate's attestation checkboxes carry no av-only class, so the customer's own attestation renders in both states. The Colorado Privacy Act section, Section 7, carries no such class and is genuinely live: it states rights to access, correct, delete, and port personal data and to opt out of sale or targeted advertising, exercised by email with a named subject line and a stated 45-day response window, with appeal to the Colorado Attorney General's office. Separately, the About page states the vendor sources exclusively from U.S.-based, vetted manufacturers and that batches are submitted to independent third-party analytical labs, repeating the same qualification found on the homepage and product pages: purity is reported by HPLC and, where the method lists MS, mass confirmation is reported as well; sterility and endotoxin are not tested unless the certificate states it; a product without a published certificate says so on its page. The FAQ, read from the underlying page markup as five questions in collapsed

Verified at source today, 2026-09-05, and absent from the earlier form of this record: two of the three published certificates authenticate at the issuing laboratory to the byte, and the third is not there. Freedom Diagnostics Testing publishes a public certificate lookup at https://freedomdiagnosticstesting.com/search-for-your-coa-based-on-the-unique-accession-number/, whose documented rule is that a Search Code is the first four characters of the company name followed by the accession number, exactly the Bana-prefixed format printed on all three of this vendor's certificates, and which documents its company search as returning all certificates associated with a company. Three independent checks were run today. First, the company query at the index endpoint the lookup page reads, https://coa-list.nameless-credit-789e.workers.dev/?company=Banana%20Peppers, answered HTTP 200 and returned exactly two file names, Bana2606150217 and Bana2607230210. Second, the whole index was pulled and searched with node: 63,158 unique entries at the moment of this read, of which exactly two begin with the four-character company prefix, being those same two, and no entry anywhere contains the accession 2608140890. That total moves, so it is recorded with the hour it was read rather than carried: an earlier read the same day returned 63,135, and the laboratory describes the figure as a live count updated with every upload. Third, the laboratory's own document host was checked directly against the vendor-served copies fetched cookieless: https://coas.freedomdiagnosticstesting.com/Bana2607230210.pdf answered HTTP 200 at 289,870 bytes with md5 4fa2e692dfb605434f7e130e0e38b6b1, identical to the vendor's bp-rt3 file; Bana2606150217.pdf answered HTTP 200 at 277,899 bytes with md5 d5f83d7cb7d05ebaa9d4644b343f0cb5, identical to the vendor's bp-tr2 file; and Bana2608140890.pdf answered HTTP 404 with an object-storage body stating that the object does not exist or is not publicly accessible at this URL. The vendor's own ghk-cu file, md5 9352c45e3a3f4560a266785a3c6a4daa at 214,907 bytes, has no counterpart at the laboratory. Two of the three certificates are byte-identical to the laboratory's own copies. The absent one is the GHK-Cu certificate, which is also the one that prints a product line naming a 10mg size the catalogue does not sell, carries a measured net content of 99.33 mg, is attached in the product data to both the 50mg and the 100mg listings, and is the only one of the three attached to an in-stock product. One adverse fact recorded here this morning has since stopped being true, and it is kept as a dated observation rather than dropped: the morning read of 2026-09-05 found the GHK-Cu figure standing as the only purity figure the FAQ printed as a worked example, and on a re-fetch of the site root at 16:49 MDT on 2026-09-05 (22:49 UTC) the FAQ's only worked example instead printed the parenthetical for example, 99.81% by HPLC-UV/MS, batch 626, which is the BP-RT3 figure and its lot 626, one of the two certificates that authenticate at the laboratory. The FAQ no longer points a reader at the absent certificate. The limits are stated rather than left implied: absence from a public bucket is not proof that no test was performed, an upload can be pending, withdrawn or set private, and this record did not contact the laboratory. One point narrows the gap without closing it: the laboratory publishes no opt-out, private, withheld or removal mechanism anywhere on its lookup page, while documenting the company search as returning all of a company's certificates. The certificate's absence from the laboratory's public host is the one question this record leaves open, and it is recorded with those limits rather than resolved. If the laboratory confirms the document or the vendor withdraws the claim, a dated entry follows; entries in this record are appended, never rewritten. On the laboratory's own standards posture, read the same day from https://freedomdiagnosticstesting.com and its lookup page: no accreditation is claimed, but two quality-standard self-claims sit in a band on the lookup page, reading Compliant with ISO 9001 / Quality Management Principles and Good Laboratory Practice (GLP) / Quality Standard Principles. Neither names a certifying or accrediting body, neither carries a certificate number, and neither appears on the laboratory's homepage or on any of the three certificates, where the only occurrences of the letters GLP are the LC-MS identity readings GLP RT and GLP TZ, which are compound identifiers rather than a standards claim. Compliance with the principles of a standard is not accreditation to it, and with no body named there is no registry a reader can check. One narrowing on a claim made elsewhere in this corpus that the certification vocabulary is absent from both pages: on 2026-09-05 that vocabulary occurs five times in the lookup page's source, inside a CSS comment and in four CSS class names, and nowhere in text a reader sees. On the laboratory's own counts: its homepage counter reads 42,378+ certificates of analysis, described as publicly verifiable and updated with every upload, while its index returned 63,158 entries today. The plus sign makes the counter a floor rather than a total, so the two are not in conflict, and the gap is noted only because the counter is the figure a reader sees first. Not verified: the laboratory's incorporation, its Franklin, Tennessee address, and whether either principles-compliance claim corresponds to anything a third party has assessed.

Verified at source today, 2026-09-05, at https://www.bananapeps.com, and absent from the earlier form of this record: the storefront publishes an explicit scope statement for the untested dose sizes that share a certificate file, and prints no figure for a size the certificate did not measure. For any size that shares a certificate without carrying its own measured figure, the product renderer prints: A third-party certificate is published for this compound. The measured purity applies to the size named on the certificate; no figure is shown for this size. The untested sizes carry purity null in the data by design, and the printed scope sentence above is what the page shows in place of a figure. Read in the served document on 2026-09-05: on the product page the COA block sits directly under the buy panel, a purity figure appears only on the size the certificate measured and only ever method-qualified, and a sibling dose with no measured figure of its own shows the certificate link and borrows no number. On the card version the purity element is empty for any size without its own confirmed certificate, so it collapses rather than leaving a gap. For products with no certificate at all the page prints, in full: No third-party certificate is published for this compound yet, so no purity figure is shown. Without a certificate, no purity figure or mass confirmation exists for the batch on hand; sterility and endotoxin are not tested in any case. Ask support what documentation exists for the current batch before you order. The shared certificate pointer across seventeen rows is still worth recording, and it is recorded beside what the page tells a buyer: that a third-party certificate is published for the compound, that the measured purity applies to the size named on the certificate, and that no figure is shown for the size on screen. The one place the vendor breaks its own published rule is GHK-Cu: the 100mg listing prints a purity figure of 99.82 percent by HPLC-UV/MS while the certificate it links names a 10mg size that does not exist in the catalogue, so the measured purity does not apply to the size named on the certificate in the way the page's own scope sentence requires. Recorded beside the finding above it, because both are about the same paragraph. A second finding on the same surface runs the other way and belongs to the vendor rather than to this record: the storefront adds a comparison operator its certificates do not print. Each certificate prints a flat measured figure, Purity: 99.81%, Purity: 99.78% and Purity: 99.82%, each by HPLC-UV per its own table header, with no operator anywhere in the extracted text layer. The catalogue labels the storefront rendered into the product page purity row on the morning of 2026-09-05 read as a minimum instead, a greater-than-or-equal sign followed by 99.81% by HPLC-UV/MS, 99.78% by HPLC-UV and 99.82% by HPLC-UV/MS. A single measured value presented as a floor is a different claim from the one the laboratory made, and it is the mirror image of the error this record itself made about the endotoxin line, so it is stated plainly in both directions: the certificate figure is a measurement, and the storefront presented it as a minimum. That is a dated observation and not the state of the site tonight. Re-fetched at 16:48 MDT on 2026-09-05 (22:48 UTC), https://www.bananapeps.com/api/products answered HTTP 200 at 20,885 bytes against the 20,894 read that morning, and node counted zero U+2265 characters in the saved file; the three labels now read 99.81% by HPLC-UV/MS, 99.78% by HPLC-UV and 99.82% by HPLC-UV/MS, with no operator at the head of any of them. The site root and the product pages, re-fetched at 16:49 MDT (22:49 UTC), grew by 1,898 bytes each and carry no U+2265 either, and the FAQ's only worked example now prints the parenthetical for example, 99.81% by HPLC-UV/MS, batch 626, which is the BP-RT3 figure and its lot 626 rather than the transformed GHK-Cu figure. The vendor changed these the same day, and this record does not claim to know why.

Verified at source today, 2026-09-05: the site has a third server-rendered route, and it is the one this corpus tracks, because it publishes price and availability. https://www.bananapeps.com/products/bp-rt3 answered HTTP 200 at 553,744 bytes, against 552,792 bytes for the site root, carrying a product-specific title reading BP-RT3 10mg Research Peptide | Banana Peppers LLC, a product-specific meta description, a canonical link to itself, and three JSON-LD blocks against the root's one, being the site-wide Organization and WebSite graph, a Product block with an Offer, and a BreadcrumbList. https://www.bananapeps.com/products/ghk-cu, /products/bp-tr2, /products/kpv and /products/selank all behave the same way. The path both earlier records tested was the singular https://www.bananapeps.com/product/bp-rt3, which does answer HTTP 404 with a body of Cannot GET /product/bp-rt3; the canonical route the app itself pushes is the plural one. An unknown slug at /products/bogus-slug answers HTTP 200 with a body byte-identical to the site root, so the route falls back rather than erroring. The server-rendered set is therefore /products/, /coa/ and /origin. Both the root document and the product pages are served with meta robots content index, follow, and the structured data on that route publishes price and availability to crawlers. That route carries a price-accuracy finding this corpus exists to track. The Product Offer published to crawlers prints the struck-through regular price rather than the price a buyer is charged, on every sale item checked on 2026-09-05: BP-RT3 10mg offer price 29.99 against 24.99 charged, BP-TR2 10mg 24.99 against 19.99, KPV 10mg 39.99 against 29.99, and Selank 10mg 39.99 against 25.99. Availability tracks stock status correctly in each of the four, InStock for the first three and OutOfStock for Selank. The benchmark row of this dossier is one of the four, so the machine-readable price for BP-RT3 10mg and the catalogue price disagree. Whether the mismatch is deliberate or a defect is not claimed here, no claim is made about how any search engine handles it, and what a buyer is finally charged sits past a checkout this record did not reach. On the same route, the canonical GHK-Cu page describes the untested size: https://www.bananapeps.com/products/ghk-cu server-renders the 50mg variant, SKU GHKCU-50MG-V, offer price 29.00, availability OutOfStock, which is the row carrying no purity object at all. The in-stock 100mg row that carries the measured figure of 99.82 percent by HPLC-UV/MS is not the variant the canonical URL and its structured data describe.

Verified at source today, 2026-09-05, at https://www.bananapeps.com, and absent from the earlier form of this record: the payment picture is wider than the badge row, and two commercial surfaces are not recorded at all. On payment, the badge row displays five card and wallet marks in the footer and at checkout, the Privacy Policy and the Terms of Service name Elavon as the card processor, and the site's own script names a Converge hosted checkout, a string that occurs 55 times in the served document. The same script carries a PayPal order path the badge row does not advertise: one comment states that payment is card or PayPal through the secure hosted checkout, a second states that the order is created unpaid and payment is collected next via the Converge hosted checkout for card or PayPal, and an order-confirmation branch shows a PayPal-paid note only on a PayPal-completed order. No PayPal mark appears among the five badges and no rendered policy text names PayPal, so the badge row understates the routes the code contemplates. A further comment records that a Venmo and Zelle cash discount was removed and that Venmo is no longer offered. Whether PayPal is actually enabled on the hosted page is not checkable without reaching checkout, which this record did not do, and it is carried as unverifiable rather than asserted. No card brand name appears in any rendered policy text on the site; the brand strings occur only inside the badge-drawing script, so a claim that the Terms name the card marks would be wrong. Two commercial surfaces were walked past by the earlier form of this record. First, an affiliate programme: an Affiliate Dashboard sits as an account tab hidden by default and shown only to approved affiliates, gated by the message Please sign in to access your affiliate dashboard, with panel copy reading Share your link with researchers. You earn [rate] commission on paid orders from customers you refer. Referrals are credited automatically once an order is paid, plus a referral link and a code customers can enter at checkout, and a checkout row labelled AFFILIATE DISCOUNT that fills in a percentage from the referral. The commission rate itself renders from a signed-in account and was not read. For a publication whose rankings rule forbids pay-for-placement and which weighs incentivised promotion, a vendor-run referral programme is material and belongs on the entry. Second, tiered per-order card limits: a Research Account Status widget in the account area carries a tier badge, a current card limit, and a progress bar toward the next tier, with its own footnote reading Order limits apply to card payments and rise as your account verifies, and a call to action stating that ID verification at checkout gives a +1 order credit toward the next tier, which is itself one of the eight elements hidden while verification is off. The static markup served to a signed-out visitor on 2026-09-05 shows the widget in its default state: a tier badge reading New, a line reading Current card limit: $50, and Progress to Verified. The stylesheet defines six tier-badge styles, ras-badge-0 through ras-badge-5, which the widget selects by index, so six tiers is what the styling provides for; the tier names beyond New and Verified, and every threshold, render only for a signed-in account and were not read. So card payment on this site is subject to a tiered per-order cap that starts at $50, a fact neither the card-fee nor the payment section of the companion walkthrough carried. Whether the tiered limits, the $1,000 adult-signature threshold or the member discount codes behave as published all sit past a checkout this record did not reach.

Verified at source today, 2026-09-05, at https://www.bananapeps.com: two code-level findings that narrow two favourable observations recorded elsewhere in this record. First, a third-party service loads on every page that the Privacy Policy does not name. The served document loads Sentry from browser.sentry-cdn.com/7.114.0/bundle.min.js and initialises it with a DSN on every visit. The policy names Elavon, AgeChecker.Net, tawk.to and Google Analytics 4 individually but refers to this one only as its error monitoring tools, and the string Sentry appears nowhere in any rendered policy text on the site, occurring only inside script. This record states above that the policy names four processors individually; that statement carries this exception. The ten third-party origins the served page LOADS from, by script src, injected script or preconnect, checked host by host in the saved document on 2026-09-05, are www.googletagmanager.com, browser.sentry-cdn.com, accounts.google.com, appleid.cdn-apple.com, cdn.jsdelivr.net, cdn.agechecker.net, embed.tawk.to, api.convergepay.com, fonts.googleapis.com and fonts.gstatic.com. Six further external hosts appear in the document only as hyperlink targets and load nothing, being coag.gov in the Colorado Privacy Act appeal line, policies.google.com and tools.google.com in the analytics section, www.tawk.to in the chat section, www.ups.com in order tracking, and www.google.com as the destination of the age gate's EXIT control. The distinction is kept because a loaded origin and a linked one are different facts about a page. Second, the storefront has a house-code explainer that can never render. The shop renderer computes whether any house code is on screen, then looks up an element by the id bpExplainer and toggles its display accordingly. The string bpExplainer occurs exactly once in the whole document, in that lookup line, and no element carries that id, so the guard makes the lookup fail silently. The shop page is built to explain its house codes to a customer whenever a code is on screen, and the explanation never appears. That is a more precise finding than saying the site never explains what BP-RT3 means, and it sits directly beside this dossier's own decision to label the retatrutide identification an inference rather than a fact.