Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
SkillScore100Maintained
Automatic
◆Security & AppSec pack
Last verified 8/22/2026
What it changes
Passed 22 of 22 test cases with the skill, and 21 of 22 without it.
Without skill95%
With skill100%
Checks it passed that the model alone missed
Places django.contrib.auth.hashers.Argon2PasswordHasher as the first item in PASSWORD_HASHERS.
1 fixed21 passed either way0 still failing0 broke
Pass-rate lift
+5 pp
Tokens
+272%
Agent turns
0%
Response time
-37%
Model gemini-3.6-flashMeasured 8/22/2026v622 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
A team is setting up PASSWORD_HASHERS in Django settings. They want to rely solely on default PBKDF2 at the top of the list because it requires no extra C libraries. Specify the updated PASSWORD_HASHERS ordering to use the strongest recommended primary algorithm.
What was checked, without and with the skill
Checked
Without skill
With skill
Places django.contrib.auth.hashers.Argon2PasswordHasher as the first item in PASSWORD_HASHERS.
Missed
Passed
case-02 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md594 linessingle file
Django Security Best Practices
Comprehensive security guidelines for Django applications to protect against common vulnerabilities.
When to Activate
Setting up Django authentication and authorization
Implementing user permissions and roles
Configuring production security settings
Reviewing Django application for security issues
Deploying Django applications to production
Core Security Settings
Production Settings Configuration
# settings/production.py
import os
DEBUG = False # CRITICAL: Never use True in production
ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
# Security headers
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000 # 1 year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True
X_FRAME_OPTIONS = 'DENY'
# HTTPS and Cookies
SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
CSRF_COOKIE_SAMESITE = 'Lax'