A catch all address is just asking for a sunami of spam.

But maybe something*@example.com

I have two Gmail addresses. A public and a private. For anything that is public facing, that exposes the email or that I don't trust as much, I use the public email. For everything important, I use the private one (and sometimes with the + method).

My private address is set to forward to my public. I only respond and send email from the public email.