I'm currently looking at the project’s "credibility" mainly by checking three things: GitHub, audit reports, and upgrades/multi-signature.

Don't just look at the stars on GitHub; first see if there's recent activity, whether issues have been responded to, and if key changes are just a bunch of temporary merges...
For those that haven't been updated for half a year and suddenly undergo major changes, I would first revoke permissions.
Audit reports shouldn't be seen as a get-out-of-jail-free card; focus on "fixed/not fixed" and scope.
Many audits only cover part of the contracts, and upgrade logic is actually the easiest to overlook.

Upgrades with multi-signature are more practical: who manages the keys, how many signatures are needed, is there a timelock?
If it can be changed at any time without delay, it's like handing over your wallet to someone else.

What if on-chain tagging tools are lagging or misleading?
Then don't rely solely on tags; cross-check the authorization list and contract permissions yourself, at least have a clear understanding.

Anyway, my own habit: for new protocols, start with small amounts and limited permissions; when I see unlimited authorization, I get itchy to revoke, even if it's more trouble.
That's how I do it for now.