Recently, I've seen many people use "GitHub is very active" and "audited" as a get-out-of-jail-free card.

Honestly, beginners want to see credibility, not just whether something exists, but look at the details: don't just focus on commit counts on GitHub, check the releases and tags, see if there are clear change logs, who reviewed them, whether upgrades are just temporary changes;
For audit reports, don't just screenshot the cover, at least scan for high-risk issues to see if they are "fixed/unfixed," whether the fix is in the code or just lip service.
The most important thing is upgrade permissions: how many signers are there, what’s the threshold ratio, whether the signers are decentralized, and it’s best to also check the timelock—having a buffer period makes you feel more at ease.
Tonight, the fee rate is again extreme, the group is arguing whether to reverse or keep pumping the bubble, I’ll just first figure out the permissions and upgrade path…
My roommate also complained that I’m staring at contract addresses late at night like I’m on patrol, fine, that’s it for now.