Eh, honestly, if you're not running anything else on the box, you probably don't have to be overly proactive about maintaining it. Sandstorm handles updating its own dependencies and mitigating most kernel bugs. Maybe if you're leaving sshd open to the internet that's something to worry about, although if you read HN you'll surely know when that needs patching. :)

That said, we plan to build a "Sandstorm OS" that auto-updates everything including the kernel, and doesn't even have an SSH interface (wouldn't be useful anyway).