As an old-school protocol enthusiast, I usually judge "trustworthiness" based on three things: whether GitHub is still active (not that kind of one-year inactivity followed by a sudden burst of commits), whether the audit report clearly states what was changed and what remains unchanged, and finally, the upgrade permissions—who holds the multi-signature, what the threshold is, whether there's a delay, at least not giving a single key full control. Honestly, I’m not afraid of vulnerabilities; I’m afraid of vulnerabilities that can be secretly exploited at any time.

Recently, AI agents and automated trading systems have become popular again, with narratives flying high, but I’m more interested in how they manage permissions and signatures when interacting on-chain. The more automated they are, the easier it is to treat security as something to "fix later."

As for "long-term," I’d say about a quarter for me—enough to see a full upgrade cycle and community reactions; weeks and months feel more like emotional cycles. I also keep a low position to test the waters; I’d rather miss out than be taught a lesson.