Recently, people keep asking me: Is the project reliable?

Honestly, I won't give a definitive answer; I only look at three "clues": GitHub, audit reports, and multi-signature upgrades.

I don't pay attention to the star count on GitHub; first, see if updates are only rushed around token launches, check who is merging PRs, and whether the changes are mostly about permissions/upgrades;
don't just look at the "approved" status of audit reports, I care more about whether the issues listed as "centralization risks/upgradability" have been seriously addressed, or if they just pass it off with "risk accepted";
multi-signature is more straightforward: how many people, what is the threshold, are the signers all from the same circle, the worst is those who claim to be decentralized but hold a single key.

A few days ago, the expectations of rate cuts and the dollar index were back in the news, risk assets rising and falling together, looking lively, but the more these narratives fly, the more I want to return to these cold facts… at least I can tell who is telling stories and who is actually delivering.
I used to be quite obsessed with "only looking on-chain," but later I realized that on-chain data shows actions but not motives, so I still need to look at code and permissions together, for now.