I can't give great advice, because any resource one may point you to may be obsolete next year. I'll just write a couple general points. 1- The basics. Read

I can't give great advice, because any resource one may point you to may be obsolete next year. I'll just write a couple general points. 1- The basics. Read about securing data, hashing and salting, not logging or committing secrets, etc. 2 - Think. Think about what you are doing at all times, and how it can be attacked. Even theoretically. 3 - The OWASP top 10 is a pretty good starting point to understanding what's going on. 4 - Don't roll your own crypto. I'm always amazed at the creativity of attackers, so there's no way to write perfection. The best most folks can do is keep up with current attacks, understand how they work, and make sure you aren't writing things vulnerable to it. I think the most important advice of value I could give is that you must always keep reading, learning, and integrating. Security, like most fields such as medicine, law, or tax codes for example, requires constant learning and adapting.