A dedicated crypto device—even an old smartphone—works best, otherwise a Linux distribution or macOS is preferable.
• For cold storage, simulate every transaction before signing. Only sign when fully understanding the contract calls.