I'm now looking at the new project "Reliable or Not," and my first impression isn't about how loudly it's being promoted on Twitter, but rather checking GitHub and audit reports... But honestly, beginners shouldn't pretend to understand the code. My simple method: see if the repository has ongoing activity, if there are real discussions in the issues, and if the commit history isn't just a bunch of "sudden launches" on the same day; for audit reports, focus on the conclusions and scope, especially whether there are high risks, if they've been fixed, and what "known risks are accepted first." Also, increase permissions, have multiple signers, check who they are, and whether there's a delay (giving you time to react), which is much better than just saying "we will upgrade" as an empty promise.

Recently, the NFT royalty issue has been heated, and it’s quite similar: verbal promises to creators sound nice, but permissions and rules are only valid if written on-chain or in smart contracts; otherwise, once liquidity flows in, everyone will just do their own thing... I'm just a casual observer picking up shells, and if I see permissions too centralized or audit reports vague, I’ll just withdraw and watch.