[mattbrewsbytes]

Just reinforcing to stick with as much stuff you already know since you'll be learning about other areas. SANS web application security principles are a good start: https://www.sans.org/cloud-security/securing-web-application...

Another thing to look into might be a provider like CloudFlare which will take care of a lot of things for you. You might be thinking "who would DDos my little site/app?" I don't think anything is immune and this (or other providers) at least give you time back to focus on building your app. Its probably super cheap for small traffic domains to start with too. Its okay to not know the nitty gritty details of something not core to what you're building. Think of services like that in the beginning to just purchase/subscribe to and revisit later.