Recently, when reviewing projects, I don't look at the K-line first; I go to check GitHub and audit reports. Mainly, I want to know: who is actually maintaining this thing, and can they be held accountable if something goes wrong. GitHub isn't about how many stars it has (that's too easy to fake); I look at whether recent commits have stopped, if issues have been responded to when vulnerabilities are reported, and whether PRs are just one or two people having fun by themselves. For audit reports, don’t just look at the words "audited"; the key is whether high-risk items have been fixed, and whether the re-audit has kept up. Otherwise, it’s like a health check report where you only look at the stamp and ignore the conclusions...

I'm now more sensitive about upgrading multi-signature wallets: being able to upgrade = being able to rescue from a fire = being able to cause trouble. Basically, it depends on whether the threshold is high enough, whether the signers are decentralized, and if there’s any delay (giving the market and users time to escape). Recently, everyone’s talking about easing expectations, the dollar index, and the mood of risk assets rising and falling together. When that sentiment kicks in, I get more itchy hands... So I’ve put my sticky notes back: if you don’t understand, reduce your position; don’t mistake impulsiveness for conviction.

Am I being too cautious?
Yes, but at least I can still review and reflect while alive.