Recently, airdrop season has heated up again, with task platforms both fighting against scams and implementing point systems. The grab-and-go crowd is scrambling like they're at work... I'm actually more afraid of handing over my wallet. Newbies look at projects to see if they are "trustworthy," but I now focus on three things: don't just look at stars on GitHub, check the commit history and issues to see if someone is genuinely fixing bugs and having proper discussions; don't just screenshot the logo in audit reports, look at whether the scope is clearly written, if there are known issues "pending fix," and whether there has been a re-audit after fixes; upgrading permissions is the most critical part—who signs, how many keys, whether there are delays or public announcements, and it's best if you can see the signature address history. Anyway, I’d rather miss a few airdrops than open up too many permissions just for a little point. What I’ve learned isn’t tricks, but understanding first who can move your money.