Recently, I saw someone ask, "GitHub open source + audited = is it safe now?"

Honestly, these are just bonus points, not a shield.
If a beginner wants to check credibility, I think it's better not to focus on stars and Twitter popularity first, but to look at the commit history to see if it's been maintained consistently, whether key changes are explained, and if anyone has reported vulnerabilities in issues that were taken seriously;
Don't just look at the cover of the audit report that says "Passed," but focus on whether high-risk items have been fixed, whether there was a secondary review, and how the fixes were verified.
As for upgrading multi-signature, saying "decentralized governance" sounds nice, but are permissions minimized, who can perform emergency pauses, and are the signers just a group of people switching masks? These details are the real pitfalls.
Recently, with the tightening of compliance and tax increases, everyone's deposit and withdrawal expectations have become very sensitive.
The more anxious they are, the easier they are to be comforted by the words "audited"...
Anyway, I still stick to my old habits: diversify, take it slow, and don't believe in perfect stories.
I'm going to get to work now.