1) If you're using Github, enable security alerts (https://github.blog/2017-11-16-introducing-security-alerts-o...). This is basically looking at your package manifests and checking for known vulnerable dependencies. Django security updates work out of the box, I don't know if PHP is supported. For wordpress (and probably Drupal) there are security scanners that are worth running.