I’m currently looking at the three core elements of a project’s “credibility”: GitHub, audits, and upgradeable multi-signatures.

For GitHub, you don’t need to understand the code—first check whether updates are consistent, whether it’s full of copy-paste, whether anyone has raised security concerns in the issues, and how the team responds.

For audits, don’t just judge by the cover logo—flip to the page that shows “Unrepaired/Accepted Risks.” That’s where many of the traps are written out.

Upgradeable multi-signatures are more straightforward: how many people are involved, what the threshold is, whether the signers are independent, and ideally whether there’s a timelock—so at least you get some time to react. (I got tricked by the words “upgradable” once too…)

Recently, the regulatory dispute around privacy coins/mixers has blown up, but it’s the same principle: don’t take sides too early. First, make sure you understand the permission structure and the accountability chain before you say anything.