getting my server hacked into is certainly on my mind as i set up the server myself only out of necessity and poverty (if not financial then creative and social). i really want the data to remain private.
i have form submission secured. not only does django escape input into sql, but i have a pre-save signal that removes html tags. once concern i do have is that when a form has an error in it, the page is reloaded with the previously entered form values. i believe django templates always escape variables, but i should try writing javascript there just to make sure.
django also stores salt + hashes of user passwords, rather than the passwords themselves. django also puts non-critial information in session cookies. the real data gets looked up in the view middleware.
For protecting against attacks, the absolute rule is: Never trust anything that the user has provided. This includes form submission, URLs for requests (i.e. it could be a malformed URL), the HTTP headers, the cookies, etc. They are all vectors for an attack. The corollary to this is: validate everything. From here, you can start learning more about the creative ways your app can be exploited.
For securely transferring and storing information, you'll need to look at encryption strategies like SSL and hashes (for, e.g., passwords) and the like.
Of course we can only point you in the general direction. This is a very big topic!