When I look at a project, I focus on three things: GitHub, audits, and multi-signature upgrades.

Don’t just look at stars and commit counts on GitHub. First, check the release/upgrade history to see whether it explains “why it was changed, who reviewed it,” and then see in the issues whether someone raised a vulnerability—whether it was brushed off and shut down.

Don’t be fooled by the logos in audit reports either. Focus on the “scope” and the “known risks/unfixed items.” Some reports are written very politely, but what they really mean is, “we didn’t look at this.”

Multi-sig is even more straightforward: how many people, whether identities are public, whether there’s a timelock, and whether it can be upgraded with a single click. To put it bluntly, if someone can change the logic in the middle of the night, no amount of multi-chain on-chain data labeling can save the situation. Recently, those tools have been criticized for being lagging or potentially misleading—I truly believe that.

In any case, when I vote, I only look at: who is responsible if something goes wrong, whether it can be stopped in time, and where the money flows.