We lived and died by the OWASP recommendations at the bank that I used to work at. It's certainly a good place to start.