Lately, when reviewing projects, I’ve become increasingly lazy about listening to the stories.

First, check GitHub; is the updates intermittent, are key changes reviewed by someone, at least don’t let it be just one person self-enthusiastically submitting.
Then look at the audit reports, don’t just focus on the words “audited,” the key points are what was included in the scope, whether high-risk issues were not fixed, and if there was a re-audit after fixes;
that kind of “recommendation to strengthen monitoring” sounds very vague.
Upgrading permissions is more critical, who signs off, what are the thresholds, is there a timelock (giving everyone time to react),
otherwise one-click upgrades are almost like a black box.
Recently, fee rates are extreme again, the group argues whether to reverse the trend or keep squeezing the bubble,
I’ve lowered my expectations anyway, see if I can survive a wave of volatility, that’s much more relaxing.