A few habits that make a real difference.
One alias per service
The whole point of aliases is that when one gets compromised, the damage stops there. That only works if you're actually using separate aliases. If you use the same alias for five shopping sites and one of them gets breached, you don't know which one sold your address.
It takes two extra seconds to create a new alias before signing up somewhere. Get into that habit.
Don't put your name in alias addresses
john.amazon@yourdomain.com tells anyone who sees it both your name and which service it's for. If that alias ends up in a breach dump, it's more useful to whoever finds it.
Something like shop.a3f9k2@yourdomain.com gives away nothing.
Enable two-factor authentication
Go to Settings → Security and enable 2FA. You can use an authenticator app (Authy, Google Authenticator, or any TOTP app) or email OTP.
When you set it up, you'll get a set of recovery codes. Write them down or store them in your password manager — not on your computer. They're your only way back in if you lose access to your authenticator.
Use a strong, unique password
Your AliasFleet password should be one you don't use anywhere else. If you're not using a password manager, start. Bitwarden is free and works on everything. 1Password is worth paying for if you want something more polished.
A compromised AliasFleet password is more damaging than a compromised random shopping site — your aliases flow through here, so protect the account accordingly.
Check your active sessions
Under Settings → Security you can see all devices currently logged into your account. If something looks unfamiliar — a location you don't recognise, a device you don't own — terminate that session and change your password.
When an alias starts getting spam
Deactivate the alias immediately to stop the flow. Then create a new alias and update your email address on that service. This is the cleanest response — you don't have to change your real email, you just swap the alias.
If you suspect a data breach, check Have I Been Pwned to see if that service's data has appeared anywhere.
AliasFleet will never ask for your password by email
Any email claiming to be from AliasFleet and asking for your password or login credentials is a phishing attempt. Ignore it and report it to support if you're unsure.