Before deploying AI-generated code, apply a specific security checklist (SQL injection, exposed secrets, input validation) — don't assume it's secure just because "it works".

All data: public/internal/confidential/restricted — each class with different protection rules.

Replace one reused password across 30 accounts with unique long ones, stored in an encrypted manager.

Check all your emails on haveibeenpwned.com to know which breaches exposed your data.

5 signals revealing a phishing message before you click and surrender data.

One strong master password + password manager = more secure than 95% of people.

Email + bank + social + cloud: 2FA required. SMS is weak — use Authenticator app or physical key.

Send delete requests to 10 data brokers — Gulf via PDPL, global via GDPR/CCPA.

Firefox + uBlock Origin + Privacy Badger + DuckDuckGo = strong default privacy.

Before clicking any email link: check full sender, hover URL, urgency, spelling.

Replace all reused passwords in 30 days. One manager, one strong master.

Enable 2FA on email, bank, social, cloud. TOTP not SMS. Backup codes saved.

Every 6 months, download backup from Google/Apple/Meta. Backup + your right.

Every browser extension can read your visible pages. Delete what you haven't used in 30 days.

On public WiFi: always VPN + no banking + 2FA even if feeling safe.

Phone encrypted by default, but your laptop? Check. If stolen, data exposed.

Know when to ask AI to generate new code versus review existing code — the two uses need different prompts and different caution.