Lately, when looking at projects labeled "trustworthy or not," I tend to first check GitHub and audit reports, not to pretend I understand everything... but to see if they have laid out the structure for you. On GitHub, there should at least be continuous commits, issues with responses, and clear upgrade records; in audit reports, don’t just look at who signed the cover page, but also want to see how high-risk issues are fixed, whether there is a re-audit, and whether those "known risks" are just glossed over.

There's also something I personally value a lot: multi-signature upgrades. Who the signers are may not be familiar, but whether the threshold is set, if there’s a timelock, and who holds the emergency pause rights—can these basic details be transparent? Recently, large on-chain transfers and hot/cold wallet movements at exchanges are often interpreted as "smart money," but honestly, I find this over-speculation a bit annoying... I’d rather spend ten more minutes checking the permission structure, at least to have a clear mind. Anyway, whenever I see "immediate upgrade" without any details, I tend to stay far away.