I used to really think that "GitHub updates are frequent + audit reports = stability," and seeing multi-signature upgrades made me feel even more secure, thinking someone is overseeing it. Now I realize these things are at most "checkable traces," not talismans: GitHub needs to verify if the core logic is really there and if changes are explained; audit reports require reading the conclusions and scope, understanding which parts weren't audited and which are "known risks left as is"; multi-signature shouldn't just be about the number of signers, it's better to look at who the signers are, what the threshold is, and whether there's a delay or announcement period, otherwise once upgrade permissions are enabled, rule changes happen faster than I can change NFT royalties... Recently, everyone has been obsessing over staking unlocks and token unlock calendars, causing anxiety over sell pressure. I now prefer to casually check a project's upgrade path and permission boundaries, at least to have a clear mind, for now.