Checking protocol documentation on the way to work, I found many people asking "Is active GitHub = safe?"

I'm now more inclined to see it as a side aspect: whether commits are continuous, whether it's just a bunch of bots changing readme files;
whether the key logic has tests, whether people are serious about bugs in issues, how developers respond...
these are more reliable than just "how many stars."

Audit reports shouldn't be treated as a get-out-of-jail-free card either,
I usually first look at the conclusion: "Fixed / Not fixed / Accepted risk,"
then check the scope: which contracts were audited, whether it was only a specific version, whether it still counts after upgrades.
The easiest thing to overlook is multi-signature upgrades: who has the authority to decide, how many keys are needed, whether there's a timelock (at least giving you some reaction time).
Basically, if upgrades are possible, it always means the "people" layer risk remains.

Recently, news about tightening or loosening compliance has made deposit and withdrawal expectations particularly sensitive...
At this point, I care more about whether multi-signature members are decentralized, whether there are transparent change records,
otherwise, no matter how beautiful the on-chain data looks, if off-chain sentiment tightens and everyone rushes together, it can get ugly.
Anyway, I personally prefer to go slower, trading some peace of mind for the confidence that comes from understanding what I see.