I look at whether a project is "reliable or not" and don't first focus on the narrative; I start by checking GitHub and audit reports, and also glance at whether the upgrade permissions are multi-sig. Beginners shouldn't be scared; keep it simple: GitHub isn't about how many stars it has, but whether someone has been actively working recently, whether the changes are concentrated among one or two people, and whether issues are being discussed when problems arise (I will directly downgrade if there are no responses). Don't just look at "pass/fail" in audit reports; focus on how high-risk issues are handled: whether they are fixed, patched, or just dismissed with a statement like "known risks accepted." Upgrading multi-sig is more practical; who can change the contract with one click, what the signature threshold is, whether there is a timelock (giving everyone time to react)—these are more honest than the "decentralized" claims on posters. Recently, compliance for deposits and withdrawals has been tightening and loosening; I personally care more about whether the project can survive slowly according to rules in the worst-case scenario. Honestly, this depends on habit: spending ten extra minutes before each entry to check these things can really help avoid many pitfalls in the long run.