Lately, when I look at projects, I tend to review GitHub and audits first, not to pretend to be professional... Mainly to find some signals of "credibility." GitHub isn't about how many stars it has; honestly, it's about whether updates are continuous, whether the same group of people has been working long-term, and whether key changes are well explained; those that haven't moved for a while, then suddenly have a big update and conveniently change permissions, I will first reduce my holdings.

Don't idolize audit reports either; focus on whether they highlight high-risk points, whether the team has genuinely made changes, and whether there has been a review or public comparison after modifications. Also, consider multi-signature upgrades: who the signers are may not be understandable, but the thresholds, delays, and whether emergency pauses are possible can at least indicate whether "something goes wrong, can it be instantly changed with one click."

Recently, the security of staking/sharing being criticized as a "copy-paste" I can understand... The compounded yields are tempting, but what I care more about is: are risks layered on top of each other, and in the end, no one clearly states who bears the ultimate responsibility? Anyway, I hold a light position and watch slowly; being able to sleep well is better than anything.