In the past, when I looked at projects to determine if they were "trustworthy or not," I mainly focused on the candlestick charts and the hype in the chat groups... As a result, during attention shifts to memes and celebrity shoutouts, I was most likely to impulsively jump in at the last moment. Now I usually first brew a cup of tea and look at three things: whether GitHub has continuous updates (not just a sudden surge), whether the audit report clearly states what issues were fixed and which are "resolved/unresolved," and whether the upgrade permissions are multi-signature, whether the signers are dispersed, and if the threshold is sufficient. To put it simply, these don't guarantee safety either, but at least they can filter out a bunch of projects that are more about storytelling than coding. When the hype is high, don't rush to drink; slow down a bit, and you might avoid a few more pitfalls.