Django REST framework 3.18

Apply the Python 3 and included Django 5.2 prompts first. DRF 3.18 also supports Django 6.0 and 6.1; on those releases keep the installed Django version and treat 5.2-specific version and patch statements in the baseline as not applicable. These rules cover Django REST framework 3.18 serializers, authentication, permissions, queryset isolation, parsers, throttling, and API deployment.

Serializers and writable fields

• Declare serializer fields explicitly for security-sensitive APIs instead of exposing every model field.
• Do not set Meta.depth on serializers whose relations reach users, credentials, tenants, or other sensitive models. DRF builds the generated nested serializers with fields = '__all__', so depth = 1 over a relation to User returns password, is_superuser, is_staff, and email even when the outer fields list is explicit; declare explicit nested serializers with allowlisted fields instead.
• Mark ownership, tenant, role, price, status, audit, and server-generated fields read-only. Set read_only=True on explicitly declared fields because Meta.read_only_fields and extra_kwargs do not override them.
• Validate cross-field invariants in validate and field invariants in the corresponding validator methods.
• Do not rely on serializer field default values during partial=True updates because DRF does not apply them; validate invariants against the supplied fields plus the authorized current instance, including privileged values that an omission would retain.
• Override nested create and update behavior explicitly and prevent