How do I verify a GitHub repository before using it?
When a README claims “deployed on X” or lists contract addresses, you need more than trust.
1. The problem
Repos publish addresses, screenshots, and marketing. You still need to know: is code actually at that address on the claimed network? Is mint or admin still open when they say it is locked?
2. What you can check yourself
- Find claimed chain ID and contract addresses in the repo.
- Call public RPC:
eth_chainIdmatches the claim. - Call
eth_getCodeon each address — empty means not deployed (or wrong chain). - Compare docs to live state: mint open? liquidity? often gated even when code exists.
That is the core of independent verification — claims vs re-checkable facts.
3. Real example
Quantum Pi Forge publishes its own addresses and status. You can re-run the same checks:
- Public verify portal
- Status JSON (mint/LP marked not authorized)
- Internal example write-up: Certificate #000 in the repo
4. Next step
Free: follow the self-serve path and check any public address yourself.
Optional paid: QPF Verification Certificate — we produce the evidence package and label what we did not verify.