Raspberry Pi as a web server security
You can try putting your Raspberry PI on separate vlan and put your home devices on another vlan. Please note you need a router which supports vlan and configure it in a way that the both vlans cant talk to each other 
Also, try using HTTPS for your webserver and don't run the webserver process as root user. If you want to go more crazy you can put a firewall.
These are generic suggestions for hardening the security for any web app.
I'm currently making a small hobby project where I use a Raspberry Pi Zero to control a set of RGB LED's.
I've got a basic python app so far that is built on Flask that allows me to set up a web server so that the LED colours can be set remotely.
My main concern is that I'm self-taught as far as programming goes and I don't know squat about security.
The plan is essentially to be sending any port 80 traffic to the raspberry pi on my home network and give friends my IP. I may eventually get a domain name to simplify things.
Should I have any security concerns when I set this up live full-time? I don't know if it's possible to access my private network via the raspberry pi or if I'm just being paranoid.