Since apparently it is not simple enough:

🚨 If your *passphrase* was generated using the Coldcard, assume it is leaked.

⚠️ If you used microSD to store your passphrase, destroy the microSD, as it can be decrypted.
⚠️ If you used Coldcard Cosign and did not set your own seed, assume the privacy of your funds is rekt.
⚠️ If you split your seed with SeedXOR, only one part of it can be used to get the whole seed. (Most of the time)
⚠️ If you used the password generator on the Coldcard, consider the generated passwords compromised.

✅ If you previously used HSM mode, that is fine. Stop using it, though.
✅ Key teleport is safe.
✅ If your seed was generated with dice, it is safe.