Are there some github repos you can recommend that follow these practices (for learning from them).
https://github.com/TryGhost/Ghost https://github.com/TryGhost/Ignition
Most of this stuff is just from experience and knowing what you need in a production application. Can you get away with no logging/monitoring? Sure, but I'd hate to be the guy trying to debug an error. Similarly, rotating keys sucks and you never want to explain to an auditor why sensitive info isn't encrypted.