As someone who places orders, I actually judge the credibility of a project based on three things: GitHub, audits, and multi-signature upgrades.

I’m not very good at reading code on GitHub, so I mainly look at the update frequency and whether the same one or two people are consistently handling it. If a bunch of unfamiliar accounts suddenly rush in, I get a bit suspicious…
Don’t treat audit reports as a get-out-of-jail-free card either; mainly check if there’s a list of “fixed/not fixed” issues, and whether the auditors are those with recognizable names.
Multi-signature is even more critical: who holds the upgrade permissions, how many keys are needed, whether there’s a time lock—basically, can they change your rules in the middle of the night.
Recently, L2 projects are still arguing about TPS and subsidies, but I actually want someone to remind me not to get carried away by the hype.
Slow down, understand the permission structure clearly before placing an order. That’s all for now.