Django Security Checklist

Django's template engine auto-escapes HTML by default. Never use the `|safe` filter or `mark_safe()` with unsanitized user input.

Use Django's ORM for all database queries. When raw SQL is needed, always use parameterized queries: `cursor.execute('SELECT ... WHERE id = %s', [user_id])`.

Keep Django's CSRF middleware enabled. Use `{% csrf_token %}` in all forms and configure CSRF for AJAX requests.

Set `DEBUG = False` in production. Debug mode exposes detailed error pages with sensitive information.

Use Django's built-in password hashing (PBKDF2 by default) and never implement custom password storage.

Configure `SECURE_SSL_REDIRECT`, `SECURE_HSTS_SECONDS`, `SESSION_COOKIE_SECURE`, and `CSRF_COOKIE_SECURE` in production settings.

Use `django-ratelimit` or Django REST Framework's throttling for rate limiting on authentication and API endpoints.

Keep `SECRET_KEY` secret and unique per environment. Rotate it if it is ever exposed.