If there's an IRC channel, mailing list, issue tracker, etc., I have a look at it. Active communities are bonus points regardless of the bug list. I also look

If there's an IRC channel, mailing list, issue tracker, etc., I have a look at it. Active communities are bonus points regardless of the bug list. I also look at how friendly the project is to pull requests and outside development. If a bug is important to me, I will spend the time to code a fix, but if there's no hope for getting any changes made, that represents a large risk to me. It's not a bad thing if the team in charge pushes back for higher quality code, code style, or solutions practical for wider audiences. If there's continuous integration in place with automated testing and static code analysis that is fantastic. It's not a deal breaker if it's not, but having it in place is a good sign. Depending on the project, I may have a look at the source itself. I certainly don't look the source of every application I use. I have found that online recommendations in developer communities are not always good. More than once I've tried out projects based on people evangelizing them only to find out that they are pretty far from acceptable. There are differences in how I judge things that will be customer facing or that I'm going to have to support operationally. I'm a lot more critical at that point, but my top 3 points are: 1. Can I put it in a container. 2. Are the developers committed to long term support. 3. Will they give me a t-shirt.