Recently, when I look at projects, I start by checking GitHub, not whether I can write code… Mainly looking at the update frequency, whether the changes are concentrated in a few people's hands, and if issues have responses. Don't treat audit reports as a talisman; focus on the scope (what was audited, what wasn't) and how high-risk items were ultimately fixed—some just pass with a phrase like "accept the risk." Upgrading multi-signature is even more critical: how many keys, who holds them, whether there's a timelock, and if the rules can be changed overnight. Now everyone complains that validators make too much money from MEV ordering, and retail investors feel like they're being cut in line. I actually care more about the protocol not adding another backdoor that allows arbitrary front-running. Reading these things is like looking at travel guides or rental contracts—there's no guarantee you won't get caught in a trap, but at least you know where the pitfalls are.