Coinbase is about as safe as an online exchange and wallet can get, however you really should get an independent wallet whether that's desktop, mobile or offline. If you have poor security practices this could be riskier than leaving your coin at Coinbase but the real reason is to get yourself into the habit of not relying on central entities (and forcing yourself to improve your security practices). If you don't transfer your coin to a wallet it's easy to start treating Coinbase as a bank when digital currencies are more like cash. The exception is if you don't plan on holding and instead plan on trading in and out because you'll have to pay the transaction fee to get it back to the exchange when you want to sell.