1. Check their partners and investors. If they have big investors it means project is liable.
2. Check little about project through website and whitepaper. If you don't have technical knowledge then check reviews on Icobench or Icodrops.
3. Check their team members
4. Check if they already have MVP ready. Good projects usually have MVP ready before ICO.
I agree with your four-point, if the project make good and already like MVP I’ll check like github source, technical project and core-team also surfing at linkedin about project
For me, I first search the rating of ICO that rated in some ICO tracking sites. If there is high ranked by experts, I join with their telegram group and search who the behavior of admins. If I feel some satisfaction, I join with bounty campaign. Even after if i don't satisfy with behavior of bounty manager, I don't continue bounty.
Also,
this one of my habits when I want to join the project campaign. I always be part like this and ask a question about project in group, well it’s same such as four points above to more an asking.