django-security

Use the Django ORM, which automatically escapes query parameters, or pass parameters to raw() queries as a list. Never interpolate user input directly into raw SQL strings with f-strings or concatenation.

Add a role field to a custom user model with choices like admin, moderator, and user, then enforce access with mixins that raise PermissionDenied in dispatch(). You can also combine Django groups and custom model permissions for finer control.

Set DEBUG to False, configure ALLOWED_HOSTS, enable SECURE_SSL_REDIRECT, HSTS, secure and HttpOnly cookies, and X_FRAME_OPTIONS. Load SECRET_KEY from environment variables and raise an error if it is missing.

Check the file's magic bytes with python-magic or the filetype package against an allowed MIME list, cross-check the extension, and enforce a size limit in model validators. Serve uploads from a separate domain or storage like S3.

Yes, Django templates auto-escape variables by default. Avoid using the safe filter or mark_safe on user input; use escape() or format_html instead, and add CSP and X-XSS-Protection headers for defense in depth.

Configure DRF throttling with AnonRateThrottle and UserRateThrottle in DEFAULT_THROTTLE_CLASSES and set rates like 100/day for anonymous users. Create custom throttle classes with scoped rates for burst or sustained limits.