As a beginner, I look at whether a project is "reliable or not."

For now, I won't focus on those grand narratives; I'll start with three things: GitHub, audit reports, and multi-signature upgrades.
GitHub isn't about how many stars you have... I mainly look at whether there's recent activity, if one or two people are working behind closed doors, and if issues are being followed up on.
Audit reports shouldn't be treated as a talisman either; the key is whether they clearly define the boundaries: what was audited, what wasn't, how known risks are handled.
Otherwise, it's like a health check that only measures blood pressure and claims you're healthy overall.

I consider multi-signature upgrades as "who holds the keys to the house": how many keys are there, who holds them, whether it's possible to add or replace keys temporarily, and if there's a time lock for everyone to react.
Recently, the repeated stacking of yields through pledge/sharing security has been criticized as a Ponzi scheme.
I'm actually more interested in whether the underlying permissions are also stacking...
Anyway, I still stick to my old approach: small positions layered, observing slowly, and not getting carried away by a single PPT slide.