Buy licensed. Ask what's in the oil. Read the batch document and match its code to your package. Then judge the hardware. Four checks, in that order, because the first one does most of the work.
Check one: where did you buy it?
This is the check that matters most, and it's the one people skip because it feels like it isn't about the product.
California requires cannabis retailers to hold a license, and products sold through licensed retailers are required to be tested before sale and labeled accurately. A shop operating outside that system carries none of those obligations. The state maintains a public register, so verifying a retailer takes about ten seconds and you only have to do it once per shop.
The reason this outranks the other three is historical. When investigators examined the 2019 outbreak of vaping-related lung injury, the CDC reported that THC-containing products from informal sources, meaning friends, family and in-person or online dealers, were linked to most cases and played a major role. That's a supply-chain finding rather than a product-category one, and it's why buying inside the licensed chain does more for you than any inspection you can perform at home.
A counterfeit cart is designed to survive exactly the checks a buyer can run by eye. Packaging is easy to copy. A license is not. That asymmetry is the useful part. Counterfeit operations invest where buyers look, and buyers look at the box. Nobody counterfeits a state license register entry, because it isn't the kind of thing you can print. It's also the check that protects you from the failure mode you can't see. A counterfeit cart doesn't announce itself by tasting wrong, and by the time anything is noticeable, the decision has already been made.
Check two and three: the ingredients and the batch document
These two get run together because each one covers what the other misses.
The ingredient question is what's in the oil besides cannabis and terpenes. Cutting agents such as propylene glycol, vegetable glycerin, polyethylene glycol and MCT oil are additives used to change viscosity and stretch volume, and vitamin E acetate is the additive the 2019 investigation centered on. We use none of them, and the aroma in our refined oil comes from cannabis-native terpenes.
Here's the part most pages skip: a compliance certificate largely can't answer that question. The panel set tests for contaminants and cannabinoid content, and cutting agents are neither, so a routine document has no line for them. Across our own library of 502 certificates, not one mentions any of those additives, which is expected rather than reassuring. The ingredient question goes to the brand. Which makes the quality of the answer informative in itself. A producer who can name what goes in and what stays out, in a sentence, is describing a formulation they control. A producer who redirects to their certificate is answering a different question than the one you asked. Neither answer has to be defensive. A brand using a carrier agent for a legitimate viscosity reason can say so plainly, and that's a more useful conversation than a vague denial.
Check four: does the hardware matter?
Hardware is the component buyers judge last and interact with most.
A cart is a tank and a heating element, and the element is usually a ceramic coil. Ceramic heats evenly and contributes no flavor of its own, which is why we use ceramic hardware. Older wick materials could scorch and add something to the vapor that nobody chose to put there.
Two practical failure modes come from hardware rather than oil. A coil running hotter than the ceramic can wick produces a burnt draw, and ceramic mismatched to a thick oil starves and clogs. Neither is a safety event, and both waste product and ruin the experience. They're also the two complaints most often blamed on the oil when the hardware is responsible, which is worth knowing before you write off a producer over a cart that was simply mismatched to your battery.
Hardware also has a testing consequence worth knowing. Traces of solvent used in manufacturing and cleaning can appear on a residual solvents panel long after extraction is finished, including on solventless products. Every result still has to sit under its action level. The gap between a detected trace and its limit is usually large, and reading only the amount column without the limit column beside it is how people alarm themselves over a compliant result. That's a reason to read the limit column rather than react to the presence of a number.
How often should you run these checks?
Less often than the list implies, because most of them stick.
Check one is a one-time job per shop. Once you've confirmed a retailer holds a license, that answer holds until something changes, and the register is there if you want to re-confirm after a gap.
Check two is per brand rather than per purchase. A producer's formulation position doesn't change between batches, so once you've asked what goes into the oil and received a straight answer, you can carry it forward.
Check three is the one that genuinely repeats. Certificates are issued per batch, so a new purchase is a new document, and matching the code takes seconds at the counter.
Check four is per device and effectively permanent. You'll judge hardware once when you choose a format and rarely think about it again.
One habit beats the rest: the whole routine costs real effort exactly once. After that it's a code match at the register, which is a small price for knowing what you're holding.
What these checks cannot tell you
Being straight about the boundary is the point of a criteria page.
They can't tell you a product is risk-free. Inhaling anything carries risk, the long-term data on cannabis vaping is thinner than anyone would like, and no combination of paperwork changes that. What the checks do is remove the failure modes that are known and avoidable. That's a smaller promise than the category usually makes and it's the one we can keep. Known and avoidable covers a great deal: untested product, counterfeit packaging, additives nobody disclosed and contamination the panels are built to catch.
They can't tell you about anything outside the panel set. A substance nobody tests for produces no line at all, which is why the ingredient question has to be asked directly rather than inferred from a clean document. The same limit applies to anything novel. A panel set is a list written in advance, so it's always slightly behind whatever someone thought of most recently, and that gap is closed by regulation catching up rather than by a buyer reading harder.
They can't tell you how the product will affect you. Individual response varies, and that's outside what a certificate or a license register describes.
And they can't substitute for your own judgment about how much you use. This page is about what's in the cart and where it came from, which is the part a buyer can actually control. Control is the honest frame for all four checks. None of them makes a decision for you. They narrow the question from is this safe, which nobody can answer, to do I know what this is and where it came from, which you can answer in about a minute.
