django-security

Comprehensive security guidelines for Django applications to protect against common vulnerabilities.

| DEBUG = False | Never run with DEBUG in production | | HTTPS only | Force SSL, secure cookies | | Strong secrets | Use environment variables for SECRETKEY | | Password validation | Enable all password validators | | CSRF protection | Enabled by default, don't disable | | XSS prevention | Django auto-escapes, don't use |safe with user input |

| SQL injection | Use ORM, never concatenate strings in queries | | File uploads | Validate file type and size | | Rate limiting | Throttle API endpoints | | Security headers | CSP, X-Frame-Options, HSTS | | Logging | Log security events | | Updates | Keep Django and dependencies updated |