Question/Advice - Security Best practices?

So far, i've made a few personal projects, only used locally with no online infrastructure, so haven't really had to worry about security.

Now, I'm building an internal company reporting tool, and with it having various online functions I need to make sure its secure.

I've been seeing a lot about security flaws in vibe-coded projects, especially on this sub and others. Beyond me saying to cursor "make this secure plz, thx lol", does anyone have any concrete recommendations or best practices I can use to implement my project to be secure? At least up to a reasonable, due diligence standards.