Oath Research review verdict: editorial conclusion

Claim examined: the peptidescore.com heavy-metal allegation

One third-party site has published a heavy-metal contamination claim against three of the vendor's GLP-1 products (Retatrutide, Semaglutide, Tirzepatide) with a Grade E rating. This review engages it directly, in five layers — and the order matters. The first layer is about who is making the claim and how that party makes its money. The remaining four address chemistry, methodology, and corroboration.

Finnrick markets a $279-per-month Premium program to the same peptide vendors it publicly rates. That structure is documented in two independent third-party publications outside Finnrick's own marketing: an investigative piece by Peptide Protocol Wiki titled "Finnrick Analytics: Transparency Concerns" and a substack essay by Derek Pruski titled "The Truth About Finnrick." A reviewer that monetizes the rated parties — that sells subscriptions to the entities it publicly grades — is not an independent reviewer. It is a marketplace participant with editorial leverage. That is the central credibility-destroying fact about the rating, and it lands before any question about the specific chemistry the rating cites. Independently corroborated

Finnrick rates EQNO at Grade A with a perfect 10.0 across four tested products (NAD+, Retatrutide, Semaglutide, Tirzepatide). RealPeptidesScores rates the same EQNO at Grade D — "Avoid — thin evidence." Four COAs visible, the most recent over three hundred and sixty days old at audit time. Two reviewers, the same vendor, the same window, opposite-direction conclusions.

When the same vendor receives wildly divergent grades from two reviewers in roughly the same audit window, the methodological gap belongs to the reviewer whose grade is unanchored from independently observable reality. Finnrick's grade for EQNO sits at the top of the scale on a thin underlying dataset; the independent reviewer reads the same dataset and lands at "Avoid." A reviewer that grades A-with-perfect-10s on one vendor and E-with-fabricated-chemistry on another, in the same calendar, is not calibrated. It is unreliable. The pattern is not "Finnrick is strict and others are lax." The pattern is "Finnrick's grades do not predict what an independent reviewer finds on the same evidence."

The editorial reading is straightforward. A heavy-metal allegation against a vendor, published by a pay-to-rate scoring service whose business model documents a structural conflict of interest with the entire population it grades, on a selection of three products with no methodology, no laboratory, and no corroborating source, against the backdrop of a CLIA-certified lab program with 199 publicly archived certificates and convergent positive signal from five other reviewers, is not evidence. It is leverage in a commercial relationship the rated vendor declined to enter. We engage it because the claim sits in the public record and readers will encounter it; we do not concede that it has merit.

Claim examined: algorithmic young-domain trust scores

Two automated trust-scoring services flag the vendor with low scores. ScamAdviser reports Trust Score 0. Scam-Detector reports 38.6. Neither service reports a single user-submitted complaint behind the score. The score is the algorithm's opinion, not human discourse.

What the algorithms actually measure is worth unpacking. The factors they flag — WHOIS privacy enabled, domain age under twelve months, DV-grade SSL certificate, traffic-to-age ratio — are present on the majority of legitimate new business websites. WHOIS privacy is the default for most modern domain registrations. Domain age under twelve months is, by definition, the condition of every new legitimate business. DV-grade SSL is the standard certificate tier for small-to-medium businesses. A new business with a fast-growing traffic profile trips the traffic-to-age ratio flag.

In plain terms: these are new brand indicators, not scam indicators. Reading them as scam markers is a category error. The signal that matters for legitimacy — a federally registered CLIA laboratory, a public batch-level certificate archive, human-edited third-party scoring at Grade A — these algorithms do not check. They cannot. They are not designed to evaluate laboratory credentials, third-party listings, or customer-verification programs.

This is not an attack on the services. ScamAdviser and Scam-Detector serve a real purpose for phishing sites, fly-by-night scams, and domain-squatter pages. The category they catch well is "is this a phishing site?" The category they do not catch is "is this a legitimate young business with verifiable operational credentials?" Confusing those is the editorial point.