I set a strict rule for myself: don't just rely on the project team's words like "security" or "audited," first check the most boring pages in GitHub and the audit reports.

I don't pretend to understand code on GitHub; mainly, I look for whether there are ongoing updates or long-standing unresolved issues in the issues section.
For audit reports, I focus on two things: whether high-risk issues have been addressed, and whether the scope of the audit only covered minor details.
Upgrading multi-signature wallets is the same; in simple terms, it's about "who can move funds/modify contracts," whether the signers are independent, whether the thresholds are reasonable, and if there are mechanisms like timelocks for buffers.
Recently, the main public chain is planning an upgrade that requires downtime, and everyone is speculating whether they'll migrate.
I'm actually more concerned about: when such node-level fluctuations happen, whether the project's permissions and emergency mechanisms can be easily "temporarily accelerated" and changed...
Anyway, I prefer to miss out rather than rely on trust built on love and energy alone.