The short list that prevents most disasters
A password manager, unique passwords, and multi-factor on email, the platforms, and your bank. Prefer an app or a key over SMS when you can, because phone numbers get swapped. Recovery codes printed and stored somewhere that is not the email inbox.
Do not download "stream overlays" from a random Discord. Do not grant a bot or an app more access than the job needs. Check active sessions when something feels off. Stream-sniping and doxxing are separate problems: do not show mail, school, or a window that has your address.
- Email is the master key. Lock that first.
- Fake sponsor emails are the common door. Verify the domain.
- Log out of old PCs and shared editors.
- Have a second person who can help you recover, and tell them before you need them.