OP, it looks like you're mainly a developer, looking at your contributions. So what can a developer do to increase the security?
In the first month:
- 2 hours: Attempt to bump a version some external dependencies/components/libraries and try to re-build the app. Document the incompatibilities if you fail.
- 2 hours: Do whatever is needed to push your own changes through CI/CD, through testing, through
master branch, and to production. Do try to piggy-back other development if there is any, but in this case pay special attention to leave trails that you've actually did something useful (e.g. author some PRs).
Repeat every month but adjust the division line between the two as you go. (Chances are that the final split will be more like 10 minutes versus 3 hours 50 minutes.)
This way you fix the worst vector - that one of popular components/libraries has a months-old published vulnerability (CVE). Swarms of bots start to scan the entire Internet pwning every vulnerable deployment. If you just upgrade the third-party components, even only by making (informed?) guesses, there is a decent chance that you will never become a victim and will never need to handle the truly unpleasant situations.
That's quite trivial for developers, but in most companies developers avoid such uninteresting maintenance. It's becomes a big issue for the typical security departments (as they don't re-compile applications). The grand efforts to "analyze logs" or "implement WAFs" or "perform vulnerability scans" are there mainly to cover that gap from all remaining possible angles.
From your question, it looks like you are asking how to focus your learning. I'd like to challenge that assumption here and now. Whoever allocated you 4 hours per month already cut off their own application from benefiting from your self-education. Irresponsible of them! To learn something dedicated to this project, then implement it, then learn on your errors and iterate... That cannot be done in 4-hour chunks each month. Don't "fix" this, because it wasn't your decision! In this project's time do things that you already know well.
That's a starter. What you try to learn and implement in your own free time, is your preference and your own business. I think it's too broad for this site (as it may be that you decide you are not interested in security, which is totally fine), but others gave you tons of leads anyway. Look for useful things during your other projects as well. Some of the former or the latter will fit into these 4 hours and help to improve the state of the project.