Security - as much as you can, use common sense and current best practices. If there are data laws/financial concerns regarding it's function, then you will need to follow any requirements of those.
Please could you share any links to current best practices? In some of the previous comments OWASP was mentioned, apart from that are there any other resources to follow for web app security?
Generally you don't trust any input, filter anything whether it is a page link or a form field, be mindful of what you put in your database and what you serve back will not cause any problems - how external input communicates to the outside world (HTML, PDF, email, links, etc.)
Get as much of your code below web root. Use SSL. Setup regular backup and test it. Keep your code environment updated (but not bleeding edge - too new can be vulnerable too)