DEMO=0 python3 build.py after wiring real content.Most fake COAs fail on the same six points. Check them in this order.
Every genuine certificate has a report ID that returns the same data from the issuing lab's own system. A PDF with no ID, or an ID that does not resolve, is not evidence.
The batch number on the certificate must match the vial in your hand. A real certificate for a different batch proves nothing about yours.
"In-house tested" is not a laboratory. A genuine COA names an identifiable issuer you can contact independently.
No chromatogram means no evidence — just a typed number. Same for the mass spectrum.
Tested before manufactured, or a turnaround that is physically impossible, are the two common tells.
Compare the font, the resolution of the logo and the metadata of the PDF. Screenshot-of-a-screenshot is a warning sign.