I'm a newbie who just buys profile pictures for fun, and when it comes to judging whether a project is "reliable or not," I basically look for three things: GitHub that hasn't been inactive for a week and isn't just full of readme edits; audit reports that don't just show the logo—at least flip to the "Fixed/Unfixed" page to see if there are any serious issues; and permission upgrades that are preferably multi-signature, with signers not just one or two fake accounts with the same name... Anyway, I first filter out obviously perfunctory ones.

Can I understand the audit?
No, I can't, so I only check if they seriously mention "risks still exist."

Recently, the fuss about NFT royalties also seems similar: creators want income, secondary markets want liquidity, but in the end, it still depends on who makes the rules and whether they can be changed with a single click. For me, whether it can be changed, who can change it, and whether there's a buffer period before the change are more important than slogans.