I found that many new friends ask, "Is this project reliable or not?" Frankly, I usually don't look at the K-line first; I check GitHub, audits, and how upgrade permissions are managed. GitHub doesn't require you to understand the code; I first look at whether someone has maintained it recently, whether there are a bunch of unresolved bugs in the issues, and whether critical upgrades are suddenly pushed all at once. For repositories that require me to refresh/retry several times to load, I immediately have a question mark in my mind...

Don't just assume an audit report is "safe" because it's stamped. I look at two points: whether the audit scope includes core contracts/bridges/upgrade logic, and whether there's a list of "unresolved/accepted risks" at the end. The most important thing is multi-signature upgrades: how many people, what is the threshold, whether there's a delay, and whether the signers are from the same related addresses. Recently, NFT royalty disputes have been intense, which is also a trust issue: can rules be changed arbitrarily, and who has the final say after changes? Anyway, I prefer to be slower and have more transparent permissions, rather than having my assets "optimized" after an upgrade someday.