I'm now looking at the project "Trustworthy or Not," and I don't first look at who has the loudest voice.

Start with GitHub: it's not about the star count, but whether there have been continuous commits recently, whether the changes revolve around the same main line, and whether people are seriously arguing in issues but able to reach consensus on fixes.
Then for the audit report, I only focus on two points: whether the scope of the audit is clearly stated, and whether the issues found have actually been fixed (if they only list "known risks" but don't patch them, I will silently ignore them).
Upgrading multi-signature is even more critical: who are the signers, whether they are decentralized, whether there is a timelock, and it's best to see the historical upgrade records; otherwise, "upgradable" sounds a bit suspicious...
Recently, comparing RWA and US Treasury yields on-chain, it basically comes down to who to trust: trust traditional interest rates or trust the on-chain constraints.
Anyway, I prefer to break down trust into these small pieces of evidence and piece them together slowly.