A Web3 security checklist to run before every signature

Before connecting

Am I on the real domain, reached from a bookmark or official link? Is this a wallet I am willing to expose here?

Before signing

Do I understand exactly what this signature does? Is it an unlimited approval, Permit, or setApprovalForAll I did not expect?

After using

Did I disconnect and revoke what I no longer need? Are my savings kept separate in cold storage? Run it every time — it becomes automatic.