I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question) What should one look into in order

I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question) What should one look into in order to fill in OWASP's gaps?