Reasonable security baseline for self-hosted services 2026?

Source: Dev.to

High-level setup

• Linux host
• Dockerized services
• Only ports 80/443 exposed publicly
• Reverse proxy terminating TLS (HTTPS enforced)
• ASP.NET (.NET 10) with built‑in Identity + OAuth
• EF Core/ORM only (no raw SQL)
• Auto‑encoding, no user HTML rendering
• Basic security headers (CSP, HSTS, nosniff, Referrer‑Policy, Permissions‑Policy)
• Host firewall enabled (default deny incoming)
• Regular security updates (OS + container rebuilds, unattended upgrades)

Question

This isn’t meant to be enterprise‑grade, just sensible for a hobby app. Any common blind spots people usually miss at this stage (ops, maintenance, or process‑wise)?