Additional security tips
While Django provides good security protection out of the box, it is still important to properly deploy your application and take advantage of the security protection of the web server, operating system and other components.
Make sure that your Python code is outside of the web server's root. This will ensure that your Python code is not accidentally served as plain text (or accidentally executed).
Take care with any user uploaded files.
Django does not throttle requests to authenticate users. To protect against brute-force attacks against the authentication system, you may consider deploying a Django plugin or web server module to throttle these requests.
Keep your
SECRET_KEYa secret.It is a good idea to limit the accessibility of your caching system and database using a firewall.
Archive of security issues
Django's development team is strongly committed to responsible reporting and disclosure of security-related issues, as outlined in Django's security policies.As part...
