When evaluating a project's "credibility," I usually check three things: GitHub, audit reports, and multi-signature upgrades.

Don't just look at stars and commit counts on GitHub; focus on whether they've recently fixed issues seriously, whether PR discussions are normal human exchanges, and whether key changes are explained. Otherwise, a bunch of "refactor" comments can make people feel uneasy.
Don't blindly trust logos in audit reports; first look at the "Unresolved / Known Risks" page, especially related to permissions, price sources, and liquidation boundaries—whether they've been fixed, how they were fixed, and if it matches what's in the code.

Many beginners tend to overlook the multi-signature upgrade part: who can modify the contract, change parameters, or move funds? How many signatures are required? Are the signers all from the same group? Is there a timelock (giving everyone time to react)?
In simple terms, the ability to upgrade with one click being "safe" is often just good luck.
Recently, everyone has been talking about rate cut expectations and the US dollar index moving along with risk assets.
I'm actually more concerned about this kind of "non-market risk"—the market can withstand a fall, but permission breaches happen so quickly that there's no time to explain.
Let's stick with this approach for now; I prefer to be a bit slower.