Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click. The JSON export covers every table and leaves out every password, secret and token, the reporters' passphrase hashes, and webhook URLs (after restoring it on a fresh install, re-enter your webhook URLs, as you do signing secrets); the database file is the rawest possible backup on SQLite installs and keeps everything.