Recently, project teams often just throw out a GitHub link + audit report and say "it's very safe," but that makes me even more nervous... If you're a beginner trying to assess credibility, I think it's better not to focus on how pretty the code looks first, but to see "who can modify it": Is the upgrade multi-signed, how many keys are there, what are the thresholds, are the signers decentralized (not all team members), is there a timelock, at least giving you some reaction time. Also, don't just look at the cover logo of the audit; flip through a few pages to see if high-risk issues have been fixed, whether they are "confirmed" or "disagreed," and whether the audit version matches the current deployment. The same applies to GitHub—check if key changes have review traces, whether commits are suddenly a big batch... Of course, to be honest, these can only reduce the probability; when the market moves in tandem with the dollar index, rising and falling together, I prefer to treat the position as something that can be upgraded or switched off at any time. That's how I handle it for now.