By now, everyone should have a locking mailbox. We got ours 10 years ago when people were regularly snagging bank and credit card statements from mailboxes in our neighborhood. They do it with such impunity they take the info off and put the statement back — the more to lull you into a false sense of security.
There are models approved by the Post Office so the mail can be put in without a key, but a key is required to remove anything. You can buy a locking insert for your existing mailbox, or a purpose-built one of varying price and quality. New ones come in post-mounted models, wall mount, etc. Top-of-the-line “architectural” or “designer” models are about $100 - $125, but you can get something workable for $20 and up. Amazon has a good assortment, and there’s www.mailboxes.com for the high end.
If you would prefer a local, employee-owned hardware store:
Jackson's Hardware (415) 454-3740