I used to focus on APY and Twitter buzz when reviewing protocols, but now I've learned my lesson and start by checking GitHub and audit reports... Not pretending to be an expert, I just don't want to be an experience bag. If a newbie wants to look at "credibility," I think you should focus on three things: Is the code active (commit frequency, issues being responded to, not just leaving a repo untouched); audits are not just "having one is enough," you need to see what scope was covered, and whether the issues found were finally fixed; upgrading permissions is even more critical—who signs, how many signatures are required, are there delays/emergency switches, in plain terms, do they have to knock on several people's doors before a rug pull. By the way, I just thought of the recent NFT royalty disputes—creators want income, markets want liquidity—it's actually similar to permission upgrades: can rules be changed, who can change them, and do you know before they do? Anyway, before interacting now, I always open the multi-signature address to take a quick look, so I feel more at ease, and don't pay too much gas fee as tuition.