Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click. The JSON export covers every table, with every password, key and other credential redacted, and webhook URLs left out too (after restoring it on a fresh install, re-enter them as you do signing secrets); the database file is the rawest possible backup on SQLite installs.