Ask HN: Best guides (books/talks) on best practice web app security in 2018

I'm not talking about low level (but still ridiculously prevalent) stuff like simple SQL injections.

The reason I'm asking is I have an itch I want to scratch but it requires handling medical data (in the UK not the US) and I want to think very carefully about whether I want to do it.