Smart contract audits create confidence, but should they create trust?

People often treat “audited” as if it means “safe,” even though an audit only reviews a particular version of a codebase under limited time and scope.

A protocol can pass several audits and still fail because of an upgrade, configuration mistake, compromised admin key, economic attack or interaction with another protocol.

Maybe audit reports should be treated more like technical evidence than security certificates.

What information should projects display alongside the word “audited” so ordinary users understand what was actually reviewed?