Recently, when I look at projects, I tend to check GitHub first... Not pretending to understand, mainly to see if "someone is working on it": commit frequency, whether it's just one or two people supporting it, if there are real discussions in the issue tracker, not just a bunch of "gm".

Audit reports shouldn't be seen as a get-out-of-jail-free card either; I usually just scan them briefly: which contracts were audited, whether high-risk items are listed, whether issues were fixed, and if the fixes are documented—otherwise, it's like writing a paper that says "I tried my best."

Upgrading multi-signature is even more critical, basically "who can change the code or move funds with one click."
I check if the signers are decentralized, if the threshold is high, and if there is a timelock (giving you reaction time).
If not, I become even more cautious about staking/sharing security and stacking yields, especially since nested contracts have been criticized recently...
The yields look attractive, but permissions and risks are invisible.

My habit to prevent impulsive buying: first add it to favorites, sleep on it, then decide;
If I still want to buy the next day, I review the multi-signature setup and audit again—cut the impulse in half, and that's the right move.
Anyway, when FOMO hits, I usually end up losing myself.