I now judge whether a project is "trustworthy" mainly by whether it clearly states its upgrade permissions… Not that having audits guarantees stability, but at least don’t hide it. If a newbie really wants to look at GitHub or audit reports, I think focusing on two points is enough: first, whether the recent updates are normal (don’t say you’re very active if you haven’t touched it in a year), and second, whether the high-risk issues mentioned in the audit have clear fix records, otherwise it’s just “looked at but not fixed.”

And regarding multi-signature upgrades, don’t just look at how many people sign; honestly, you need to see who can change the logic, whether there’s a timelock, and if there are emergency switches and procedures in case of issues. Recently, hardware wallets have been out of stock, and phishing links are ridiculously numerous… Everyone’s security awareness has improved, but those on-chain traps like “permissions can be taken away with one click” can’t be avoided just by being careful with links. Take your time to verify thoroughly; anyway, I’d rather miss out.