Install Surf only from verified sources (App Store, Google Play) or use the web version.
Backup your master password. Ideally it should be stored in a location only you can access. Never keep it on the same device as Surf.
Do not disclose your master password to any person or any app, other than Surf. Only use it to restore access to your wallet in Surf.
Use a PIN code you can easily remember and never write it down. Don’t use the same PIN code in other applications. Don't share it with anyone.
Follow basic device security guidelines: don’t install applications from unknown sources (disable this option in the settings); carefully read requested permissions when installing apps; set up secure device lock method.
More information about security in Surf you can find at https://medium.com/freeton/how-to-keep-my-cryptocurrency-safe-in-surf-a5d5c202b38d