djangolisted

Builds, operates, and hardens Django and Django REST Framework projects - from a cold start or inside an existing codebase. Use when scaffolding a new Django/DRF project, when adding or changing models, serializers, viewsets, permissions, or migrations, when inheriting an unfamiliar Django repo and needing to orient in it, when an endpoint is slow or the ORM is issuing hundreds of queries (N+1), when a migration needs to ship without downtime, when an API is or might be exposed (DRF's default permission is AllowAny - it fails OPEN), and when reviewing Django code before merge or deploy. Ships a deterministic AST-based checker (scripts/django_check.py) for the DRF footguns that `manage.py check --deploy` does not catch, and drives Django's own tooling rather than duplicating it.
anton-winter-arch/dotagents · ★ 1 · API & Backend · score 75

Install: claude install-skill anton-winter-arch/dotagents

# django Django is safe by default. **DRF is not.** Its default permission class is `AllowAny`, so a viewset that forgets `permission_classes` is a public endpoint - no error, no warning, no log line. That single default causes more real exposure than every other item in this skill combined, and it is why the checker FAILs a `REST_FRAMEWORK` block with no `DEFAULT_PERMISSION_CLASSES`. The other three that ship constantly, all mechanical, all caught by the gate: `fields = "__all__"` (a standing promise to expose every column you ever add), writable `is_staff` (a user can PATCH themselves into staff), and `.all()` with no `select_related` (one query per row). ## First: which situation is this? **Existing project → orient before touching anything.** Read `references/runbook.md` § *Inheriting an existing project*. Their conventions outrank this skill's templates: a consistent codebase with a pattern you dislike beats one with two patterns, and the second is the one you added. Run `manage.py check`, `showmigrations`, `makemigrations --check --dry-run`, then the checker - and **triage**, do not sweep. A repo-wide fix-everything diff is unreviewable and gets reverted. **Cold start → scaffold.** Read `references/scaffold.md`: layout, split settings, the DRF config that inverts the unsafe defaults, model/serializer/viewset patterns. The templates already pass the checker. Either way, the same gate applies to what you write. ## The rules **Permissions fail open.** Set `DEFAULT_